際際滷

際際滷Share a Scribd company logo
Yoram Golandsky | November 2010
www.security-art.com
All rights reserved to Security Art ltd. 2002-2010
Cyber[Crime|War]
Connecting the Dots
Yoram Golandsky
CEO, Security Art
All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
2
Agenda
 CyberWar [Attack | Defense]
 CyberCrime [Attack | Defense]
 History revisited
 Connecting the dots...
 Future
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 3
Picking up where we left off
At least as far as last years research is concerned...
All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
4
We took a trip down the rabbit
hole
Only to find that
we are facing a
business as
organized as a
Fortune 500 one
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 5
With markets for each
aspect of the business
to cater for tools,
services and even
bringing in leads
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 6
BUT!
Something didn't make too much sense in the
data
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 7
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 8
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 9
Hungry yet?
That was just the appetizer...
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 10
Question 1: What is this?
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 11
Perceptions may be
deceiving...
War Crime
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 12
War Crime
 Government / state
 Official backing
 Official resources
 Financing
 Expertise?
 Exploits/Vulns?
 Private
 Semi-official backing (org.
crime)
 Official resources
 Self financing?
 Established expertise (in-
house + outsourced)
 Market for exploits
All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
13
CyberWar
Cyberwarfare, (also known as
cyberwar and Cyber Warfare), is the
use of computers and the Internet in
conducting warfare in cyberspace.
Wikipedia
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 14
It did not happen yet
EstoniaGeorgia being an exception?
There is no Cyberwar
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 15
This is not the only way! Neither is this...
But civilian are
always at stake!
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 16
Many faces of how CyberWar is perceived...
From McAfees Virtual Criminology Report 2009
Image caption:
countries developing advanced offensive cyber capabilities
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 17
Well focus on current players:
And no, here size does NOT matter...
All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
18
USA
 Thoroughly documented activity around cyberwar
preparedness as well as military/government agencies with
readily available offensive capabilities
 Massive recruiting of professional in attack/defense for
different departments:
 USCC (United States Cyber Command - includes AirForce,
Marines, Navy and Army service components)
 NSA
 Other TLAs...
All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
19
Russia
 GRU (Main Intelligence Directorate of the Russian
Armed Forces)
 SVR (Foreign Intelligence Service)
 FSB (Federal Security Services)
 Center for Research of Military Strength of Foreign
Countries
 Several National Youth Associations (Nashi)
All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
20
China
 PLA (Peoples Liberation Army)
 Homework: read the Northrop Grumman report...
 General Staff Department 4th Department -
Electronic Countermeasures == Offense
 GSD 3rd Department - Signals Intelligence ==
Defense
 Yes... Titan Rain...
All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
21
Iran
 Telecommunications Infrastructure co.
 Government telecom monopoly
 Iranian Armed Forces
All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
22
Israel
 This is going to be very boring... Google data only :-(
 IDF (Israel Defense Forces) add cyber-attack
capabilities.
 C4I (Command, Control, Communications, Computers
and Intelligence) branches in Intelligence and Air-Force
commands
 Staffing is mostly homegrown - trained in the army and
other government agencies.
 Mossad? (check out the jobs section on
mossad.gov.il...)
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 23
CyberWar - Attack
Highly selective targeting of military
(and critical) resources
In conjunction with a kinetic
attack
OR
Massive DDOS in order to
black-out a region, disrupt
services, and/or push political
agenda (propaganda)
All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
24
CyberWar - Defense
 Never just Governmentmilitary
 Targets are likely to be civilian
 Physical and logical protections = last survival act
 Availability and Integrity of services  Survivability
 Can manifest in the cost of making services
unavailable for most civilians
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 25
CyberCrime
25
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 26
You want
money, you
gotta play like
the big boys
do...
All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
27
CyberCrime - Attack
 Channels: web, mail, open services
 Targeted attacks on premium resources (corporate)
 Commissioned, or for extortion purposes
 Carpet bombing for most attacks (consumer)
 Segmenting geographical regions and market segments
 Secondary infections through controlled outposts
 Bots, infected sites
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 28
CyberCrime - target locations
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 29
CyberCrime - Locations
Major Cybercrime group locations
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 30
CyberCrime - Ammunition
~APT
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 31
All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
32
CyberCrime - Defense
 Anti [ Virus | Malware | Spyware | Rootkit |
Trojan ]
 Seriously?
 Firewalls / IDS / IPS
 Seriously?
 Brought to you by the numbers 80, 443,
53...
 SSL...
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 33
How do these connect?
Claim: CyberCrime is being used to
conduct CyberWar
Is it?: Lets start with some history...
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 34
History - Revisited...
Estonia
You read all about it.
Bottom line: civilian infrastructure was targeted
Attacks originated mostly from civilian networks
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 35
History - Revisited...
Israel
September 6th, 2007
Source: http://en.wikipedia.org/wiki/Operation_Orchard
Source: Der Spiegel
Operation Orchard
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 36
History - Revisited...
Georgia
More interesting, specially in our case...
Highly synchronized Kinetic and Cyber attacks
Targets still mostly civilian
Launched from civilian networks
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 37
Russian Crime/State Dilemma
McColo
ESTDomains
Atrivo
RBN
RealHost
Micronnet
Eexhost
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 38
Russian
Government
Crime
ESTDom RBN
HostFresh
UkrTeleGroup
ESTDomains
McColo
Atrivo
Hosted by
Customer
Network provider
All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
39
Remember Georgia?
 Started by picking on the president...
 Then the C&C used to control the botnet was shut down
as:
 Troops cross the border towards Georgia
 A few days of silence...
flood http www.president.gov.ge
flood tcp www.president.gov.ge
flood icmp www.president.gov.ge
All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
40
Georgia - cont.
 Six (6) new C&C servers came up and drove attacks at
additional Georgian sites
 BUT - the same C&Cs were also used for attacks on
commercial sites in order to extort them (botnet-for-
hire)
www.president.gov.ge
www.parliament.ge
apsny.ge
news.ge
tbilisiweb.info
newsgeorgia.ru
os-inform.com
www.kasparov.ru
hacking.ge mk.ru
newstula.info
skandaly.ru
Additional sites attacked:
Porn sites
Adult escort services
Nazi/Racist sites
Carder forums
Gambling sites
Webmoney/Webgold/etc
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 41
History - Revisited...
Iran
2009 Twitter DNS hack attributed to Iranian activity.
Political connections are too obvious to ignore (elections)
UN Council
Decisions
Protests by
leadership
opposition in Tehran
Timing was right on:
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 42
All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
43
Iran-Twitter connecting dots
 Twitter taken down December 18th 2009
 Attack attributed eventually to cyber-crime/vigilante
group named Iranian Cyber Army
 Until December 2009 there was no group known as
Iranian Cyber Army...
 BUT - Ashiyane (Shiite group) is from the same place
as the Iranian Cyber Army
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 44
All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
45
Iran-Twitter - Ashiyane
 Ashiyane was using the same pro-Hezbolla
messages that were used on the Twitter
attack with their own attacks for some
time...
 AND the Iranian Cyber Army seems to be
a pretty active group on the Ashiyane
forums www.ashiyane.com/forum
Lets take a quick look at how Ashiyane operates...
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 46
On [Crime|War] training
Ashiyane forums
WarGames
46
All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
47
47
Wargames targets includes:
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 48
Back to linking [Crime|War]
What else happened on the 18th?
More recently - Baidu taken down
with the same MO (credentials)
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 49
Ashiyane
Iranian Cyber
Army
DDoS
Botnet
Herding
Site
Defacement
Credit Card
Theft
Strategic
Attacks
Mapping Irans [Crime|War]
Iran
Iraq
US
$$ UK
US CN
Crime
War
All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
50
Iran - the unspoken
 Stuxnet
 There, Ive said it
Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 51
The Future (Ilustrated)
CLOUDS
All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
52
Summary
Good Bad
Formal training on
cybersecurity by nations
Commercial
development of malware
still reigns
Ugly
Good meet Bad: money changes hands,
less tracks to cover, criminal ops already
creating the weapons...
All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
53
Summary
The Future
Lack of legislation and cooperation on multi-national level
is creating de-facto safe haven for cybercrime. <- FIx
this!
Treaties and anti-crime activities may prove to be
beneficial. <- nukes? (i.e. treaties...)
All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
54
Thanks!
www.security-art.com
yoram@security-art.com
twitter.com/securityart
blog.security-art.com

More Related Content

Cybercrime|Cyberwar - connecting the dots

  • 1. Yoram Golandsky | November 2010 www.security-art.com All rights reserved to Security Art ltd. 2002-2010 Cyber[Crime|War] Connecting the Dots Yoram Golandsky CEO, Security Art
  • 2. All rights reserved to Security Art ltd. 2002-2010 Yoram Golandsky | November 2010 2 Agenda CyberWar [Attack | Defense] CyberCrime [Attack | Defense] History revisited Connecting the dots... Future
  • 3. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 3 Picking up where we left off At least as far as last years research is concerned...
  • 4. All rights reserved to Security Art ltd. 2002-2010 Yoram Golandsky | November 2010 4 We took a trip down the rabbit hole Only to find that we are facing a business as organized as a Fortune 500 one
  • 5. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 5 With markets for each aspect of the business to cater for tools, services and even bringing in leads
  • 6. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 6 BUT! Something didn't make too much sense in the data
  • 7. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 7
  • 8. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 8
  • 9. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 9 Hungry yet? That was just the appetizer...
  • 10. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 10 Question 1: What is this?
  • 11. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 11 Perceptions may be deceiving... War Crime
  • 12. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 12 War Crime Government / state Official backing Official resources Financing Expertise? Exploits/Vulns? Private Semi-official backing (org. crime) Official resources Self financing? Established expertise (in- house + outsourced) Market for exploits
  • 13. All rights reserved to Security Art ltd. 2002-2010 Yoram Golandsky | November 2010 13 CyberWar Cyberwarfare, (also known as cyberwar and Cyber Warfare), is the use of computers and the Internet in conducting warfare in cyberspace. Wikipedia
  • 14. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 14 It did not happen yet EstoniaGeorgia being an exception? There is no Cyberwar
  • 15. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 15 This is not the only way! Neither is this... But civilian are always at stake!
  • 16. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 16 Many faces of how CyberWar is perceived... From McAfees Virtual Criminology Report 2009 Image caption: countries developing advanced offensive cyber capabilities
  • 17. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 17 Well focus on current players: And no, here size does NOT matter...
  • 18. All rights reserved to Security Art ltd. 2002-2010 Yoram Golandsky | November 2010 18 USA Thoroughly documented activity around cyberwar preparedness as well as military/government agencies with readily available offensive capabilities Massive recruiting of professional in attack/defense for different departments: USCC (United States Cyber Command - includes AirForce, Marines, Navy and Army service components) NSA Other TLAs...
  • 19. All rights reserved to Security Art ltd. 2002-2010 Yoram Golandsky | November 2010 19 Russia GRU (Main Intelligence Directorate of the Russian Armed Forces) SVR (Foreign Intelligence Service) FSB (Federal Security Services) Center for Research of Military Strength of Foreign Countries Several National Youth Associations (Nashi)
  • 20. All rights reserved to Security Art ltd. 2002-2010 Yoram Golandsky | November 2010 20 China PLA (Peoples Liberation Army) Homework: read the Northrop Grumman report... General Staff Department 4th Department - Electronic Countermeasures == Offense GSD 3rd Department - Signals Intelligence == Defense Yes... Titan Rain...
  • 21. All rights reserved to Security Art ltd. 2002-2010 Yoram Golandsky | November 2010 21 Iran Telecommunications Infrastructure co. Government telecom monopoly Iranian Armed Forces
  • 22. All rights reserved to Security Art ltd. 2002-2010 Yoram Golandsky | November 2010 22 Israel This is going to be very boring... Google data only :-( IDF (Israel Defense Forces) add cyber-attack capabilities. C4I (Command, Control, Communications, Computers and Intelligence) branches in Intelligence and Air-Force commands Staffing is mostly homegrown - trained in the army and other government agencies. Mossad? (check out the jobs section on mossad.gov.il...)
  • 23. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 23 CyberWar - Attack Highly selective targeting of military (and critical) resources In conjunction with a kinetic attack OR Massive DDOS in order to black-out a region, disrupt services, and/or push political agenda (propaganda)
  • 24. All rights reserved to Security Art ltd. 2002-2010 Yoram Golandsky | November 2010 24 CyberWar - Defense Never just Governmentmilitary Targets are likely to be civilian Physical and logical protections = last survival act Availability and Integrity of services Survivability Can manifest in the cost of making services unavailable for most civilians
  • 25. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 25 CyberCrime 25
  • 26. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 26 You want money, you gotta play like the big boys do...
  • 27. All rights reserved to Security Art ltd. 2002-2010 Yoram Golandsky | November 2010 27 CyberCrime - Attack Channels: web, mail, open services Targeted attacks on premium resources (corporate) Commissioned, or for extortion purposes Carpet bombing for most attacks (consumer) Segmenting geographical regions and market segments Secondary infections through controlled outposts Bots, infected sites
  • 28. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 28 CyberCrime - target locations
  • 29. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 29 CyberCrime - Locations Major Cybercrime group locations
  • 30. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 30 CyberCrime - Ammunition ~APT
  • 31. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 31
  • 32. All rights reserved to Security Art ltd. 2002-2010 Yoram Golandsky | November 2010 32 CyberCrime - Defense Anti [ Virus | Malware | Spyware | Rootkit | Trojan ] Seriously? Firewalls / IDS / IPS Seriously? Brought to you by the numbers 80, 443, 53... SSL...
  • 33. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 33 How do these connect? Claim: CyberCrime is being used to conduct CyberWar Is it?: Lets start with some history...
  • 34. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 34 History - Revisited... Estonia You read all about it. Bottom line: civilian infrastructure was targeted Attacks originated mostly from civilian networks
  • 35. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 35 History - Revisited... Israel September 6th, 2007 Source: http://en.wikipedia.org/wiki/Operation_Orchard Source: Der Spiegel Operation Orchard
  • 36. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 36 History - Revisited... Georgia More interesting, specially in our case... Highly synchronized Kinetic and Cyber attacks Targets still mostly civilian Launched from civilian networks
  • 37. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 37 Russian Crime/State Dilemma McColo ESTDomains Atrivo RBN RealHost Micronnet Eexhost
  • 38. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 38 Russian Government Crime ESTDom RBN HostFresh UkrTeleGroup ESTDomains McColo Atrivo Hosted by Customer Network provider
  • 39. All rights reserved to Security Art ltd. 2002-2010 Yoram Golandsky | November 2010 39 Remember Georgia? Started by picking on the president... Then the C&C used to control the botnet was shut down as: Troops cross the border towards Georgia A few days of silence... flood http www.president.gov.ge flood tcp www.president.gov.ge flood icmp www.president.gov.ge
  • 40. All rights reserved to Security Art ltd. 2002-2010 Yoram Golandsky | November 2010 40 Georgia - cont. Six (6) new C&C servers came up and drove attacks at additional Georgian sites BUT - the same C&Cs were also used for attacks on commercial sites in order to extort them (botnet-for- hire) www.president.gov.ge www.parliament.ge apsny.ge news.ge tbilisiweb.info newsgeorgia.ru os-inform.com www.kasparov.ru hacking.ge mk.ru newstula.info skandaly.ru Additional sites attacked: Porn sites Adult escort services Nazi/Racist sites Carder forums Gambling sites Webmoney/Webgold/etc
  • 41. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 41 History - Revisited... Iran 2009 Twitter DNS hack attributed to Iranian activity. Political connections are too obvious to ignore (elections) UN Council Decisions Protests by leadership opposition in Tehran Timing was right on:
  • 42. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 42
  • 43. All rights reserved to Security Art ltd. 2002-2010 Yoram Golandsky | November 2010 43 Iran-Twitter connecting dots Twitter taken down December 18th 2009 Attack attributed eventually to cyber-crime/vigilante group named Iranian Cyber Army Until December 2009 there was no group known as Iranian Cyber Army... BUT - Ashiyane (Shiite group) is from the same place as the Iranian Cyber Army
  • 44. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 44
  • 45. All rights reserved to Security Art ltd. 2002-2010 Yoram Golandsky | November 2010 45 Iran-Twitter - Ashiyane Ashiyane was using the same pro-Hezbolla messages that were used on the Twitter attack with their own attacks for some time... AND the Iranian Cyber Army seems to be a pretty active group on the Ashiyane forums www.ashiyane.com/forum Lets take a quick look at how Ashiyane operates...
  • 46. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 46 On [Crime|War] training Ashiyane forums WarGames 46
  • 47. All rights reserved to Security Art ltd. 2002-2010 Yoram Golandsky | November 2010 47 47 Wargames targets includes:
  • 48. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 48 Back to linking [Crime|War] What else happened on the 18th? More recently - Baidu taken down with the same MO (credentials)
  • 49. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 49 Ashiyane Iranian Cyber Army DDoS Botnet Herding Site Defacement Credit Card Theft Strategic Attacks Mapping Irans [Crime|War] Iran Iraq US $$ UK US CN Crime War
  • 50. All rights reserved to Security Art ltd. 2002-2010 Yoram Golandsky | November 2010 50 Iran - the unspoken Stuxnet There, Ive said it
  • 51. Yoram Golandsky | November 2010 All rights reserved to Security Art ltd. 2002-2010 51 The Future (Ilustrated) CLOUDS
  • 52. All rights reserved to Security Art ltd. 2002-2010 Yoram Golandsky | November 2010 52 Summary Good Bad Formal training on cybersecurity by nations Commercial development of malware still reigns Ugly Good meet Bad: money changes hands, less tracks to cover, criminal ops already creating the weapons...
  • 53. All rights reserved to Security Art ltd. 2002-2010 Yoram Golandsky | November 2010 53 Summary The Future Lack of legislation and cooperation on multi-national level is creating de-facto safe haven for cybercrime. <- FIx this! Treaties and anti-crime activities may prove to be beneficial. <- nukes? (i.e. treaties...)
  • 54. All rights reserved to Security Art ltd. 2002-2010 Yoram Golandsky | November 2010 54 Thanks! www.security-art.com yoram@security-art.com twitter.com/securityart blog.security-art.com

Editor's Notes

  • #18: Who are the major players in Cyberwarfare now?
  • #20: GRU is very much like the American DIA (Defense Intelligence Agency) - collecting HUMINT, SIGINT, IMINT, and actively operating in technical espionage, as well as OSINT. The SVR is working closely with the GRU FSB is working closely with SVR (focused on domestic espionage) CRMSF - I shit you not! Its an official russian government entity
  • #26: Completely financially motivated Read: no political affiliation, unless $$$ Highly connected Transactions can be traced across organizations Hierarchical in nature Need to know basis, highly professional business units, many small profit centers
  • #27: Highly connected and hierarchical
  • #31: Highly sophisticated botnets Usually rented by the hour/day for spamming or DDOS Harvesting specific information (credit cards, financial data, personal information, emails, documents, applications, credentials, etc...)
  • #36: Engulfed in fog... information & dis-information all over the place. Events: Cast Led and 2nd Lebanon war kinetic and cyber links hard to find Palestinian TV station hacked for propaganda Maybe? - Syrian nuclear facility bombing in 2007 (no proof - no radar accountability of ANY aircraft in the area...)
  • #38: McColo, ESTDomains, Atrivo and RBN are all connected one way or another to the government (FSB)
  • #47: At the Ashiyane forums, theres an ongoing contest called WarGames: Sites are being targeted, participants are called to attack them - SQL injections, data theft, defacement, anything goes...
  • #52: Landscape highly unclear! Where does that put developing nations Africa? OLPC + zero enforcement of licensing = largest infected PC population in the world! Arms race is on. Government/military commissioned attacks more likely, but mainly surgical strikes No Cybergeddon for you so far (sorry CNN...) Massive connectivity is still the WMD of CyberWar (and is a commodity) No problem getting it from questionable arms dealers (bot herders) - just like we do now with conventional weapons....
  • #53: The Good Formal training on cybersecurity by nationsThe Bad Commercial development of malicious computer software (weapons manufacturers)The Ugly Good meets Bad - money changes hands, less tracks to cover (politically), criminal organizations already manufacturing arms...The Future Lack of legislation and cooperation on multi-national level is creating de-facto safe haven for cybercrime. Treaties and anti-crime activities may prove to be beneficial.