The document discusses the relationship between cybercrime and cyberwarfare. It explores how states like Iran, Russia, and China use cybercriminal groups and infrastructure to conduct cyberattacks that have both criminal and political objectives. The document examines historical examples from Estonia, Georgia, Israel, and Iran where cyberattacks on government and civilian targets occurred simultaneously with geopolitical events. It argues that the line between cybercrime and cyberwarfare is blurring as nations use criminal groups and tactics to advance their interests while denying direct involvement.
1 of 54
Downloaded 70 times
More Related Content
Cybercrime|Cyberwar - connecting the dots
1. Yoram Golandsky | November 2010
www.security-art.com
All rights reserved to Security Art ltd. 2002-2010
Cyber[Crime|War]
Connecting the Dots
Yoram Golandsky
CEO, Security Art
2. All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
2
Agenda
CyberWar [Attack | Defense]
CyberCrime [Attack | Defense]
History revisited
Connecting the dots...
Future
3. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 3
Picking up where we left off
At least as far as last years research is concerned...
4. All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
4
We took a trip down the rabbit
hole
Only to find that
we are facing a
business as
organized as a
Fortune 500 one
5. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 5
With markets for each
aspect of the business
to cater for tools,
services and even
bringing in leads
6. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 6
BUT!
Something didn't make too much sense in the
data
7. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 7
8. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 8
9. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 9
Hungry yet?
That was just the appetizer...
10. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 10
Question 1: What is this?
11. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 11
Perceptions may be
deceiving...
War Crime
12. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 12
War Crime
Government / state
Official backing
Official resources
Financing
Expertise?
Exploits/Vulns?
Private
Semi-official backing (org.
crime)
Official resources
Self financing?
Established expertise (in-
house + outsourced)
Market for exploits
13. All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
13
CyberWar
Cyberwarfare, (also known as
cyberwar and Cyber Warfare), is the
use of computers and the Internet in
conducting warfare in cyberspace.
Wikipedia
14. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 14
It did not happen yet
EstoniaGeorgia being an exception?
There is no Cyberwar
15. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 15
This is not the only way! Neither is this...
But civilian are
always at stake!
16. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 16
Many faces of how CyberWar is perceived...
From McAfees Virtual Criminology Report 2009
Image caption:
countries developing advanced offensive cyber capabilities
17. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 17
Well focus on current players:
And no, here size does NOT matter...
18. All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
18
USA
Thoroughly documented activity around cyberwar
preparedness as well as military/government agencies with
readily available offensive capabilities
Massive recruiting of professional in attack/defense for
different departments:
USCC (United States Cyber Command - includes AirForce,
Marines, Navy and Army service components)
NSA
Other TLAs...
19. All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
19
Russia
GRU (Main Intelligence Directorate of the Russian
Armed Forces)
SVR (Foreign Intelligence Service)
FSB (Federal Security Services)
Center for Research of Military Strength of Foreign
Countries
Several National Youth Associations (Nashi)
20. All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
20
China
PLA (Peoples Liberation Army)
Homework: read the Northrop Grumman report...
General Staff Department 4th Department -
Electronic Countermeasures == Offense
GSD 3rd Department - Signals Intelligence ==
Defense
Yes... Titan Rain...
21. All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
21
Iran
Telecommunications Infrastructure co.
Government telecom monopoly
Iranian Armed Forces
22. All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
22
Israel
This is going to be very boring... Google data only :-(
IDF (Israel Defense Forces) add cyber-attack
capabilities.
C4I (Command, Control, Communications, Computers
and Intelligence) branches in Intelligence and Air-Force
commands
Staffing is mostly homegrown - trained in the army and
other government agencies.
Mossad? (check out the jobs section on
mossad.gov.il...)
23. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 23
CyberWar - Attack
Highly selective targeting of military
(and critical) resources
In conjunction with a kinetic
attack
OR
Massive DDOS in order to
black-out a region, disrupt
services, and/or push political
agenda (propaganda)
24. All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
24
CyberWar - Defense
Never just Governmentmilitary
Targets are likely to be civilian
Physical and logical protections = last survival act
Availability and Integrity of services Survivability
Can manifest in the cost of making services
unavailable for most civilians
25. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 25
CyberCrime
25
26. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 26
You want
money, you
gotta play like
the big boys
do...
27. All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
27
CyberCrime - Attack
Channels: web, mail, open services
Targeted attacks on premium resources (corporate)
Commissioned, or for extortion purposes
Carpet bombing for most attacks (consumer)
Segmenting geographical regions and market segments
Secondary infections through controlled outposts
Bots, infected sites
28. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 28
CyberCrime - target locations
29. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 29
CyberCrime - Locations
Major Cybercrime group locations
30. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 30
CyberCrime - Ammunition
~APT
31. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 31
32. All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
32
CyberCrime - Defense
Anti [ Virus | Malware | Spyware | Rootkit |
Trojan ]
Seriously?
Firewalls / IDS / IPS
Seriously?
Brought to you by the numbers 80, 443,
53...
SSL...
33. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 33
How do these connect?
Claim: CyberCrime is being used to
conduct CyberWar
Is it?: Lets start with some history...
34. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 34
History - Revisited...
Estonia
You read all about it.
Bottom line: civilian infrastructure was targeted
Attacks originated mostly from civilian networks
35. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 35
History - Revisited...
Israel
September 6th, 2007
Source: http://en.wikipedia.org/wiki/Operation_Orchard
Source: Der Spiegel
Operation Orchard
36. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 36
History - Revisited...
Georgia
More interesting, specially in our case...
Highly synchronized Kinetic and Cyber attacks
Targets still mostly civilian
Launched from civilian networks
37. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 37
Russian Crime/State Dilemma
McColo
ESTDomains
Atrivo
RBN
RealHost
Micronnet
Eexhost
38. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 38
Russian
Government
Crime
ESTDom RBN
HostFresh
UkrTeleGroup
ESTDomains
McColo
Atrivo
Hosted by
Customer
Network provider
39. All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
39
Remember Georgia?
Started by picking on the president...
Then the C&C used to control the botnet was shut down
as:
Troops cross the border towards Georgia
A few days of silence...
flood http www.president.gov.ge
flood tcp www.president.gov.ge
flood icmp www.president.gov.ge
40. All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
40
Georgia - cont.
Six (6) new C&C servers came up and drove attacks at
additional Georgian sites
BUT - the same C&Cs were also used for attacks on
commercial sites in order to extort them (botnet-for-
hire)
www.president.gov.ge
www.parliament.ge
apsny.ge
news.ge
tbilisiweb.info
newsgeorgia.ru
os-inform.com
www.kasparov.ru
hacking.ge mk.ru
newstula.info
skandaly.ru
Additional sites attacked:
Porn sites
Adult escort services
Nazi/Racist sites
Carder forums
Gambling sites
Webmoney/Webgold/etc
41. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 41
History - Revisited...
Iran
2009 Twitter DNS hack attributed to Iranian activity.
Political connections are too obvious to ignore (elections)
UN Council
Decisions
Protests by
leadership
opposition in Tehran
Timing was right on:
42. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 42
43. All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
43
Iran-Twitter connecting dots
Twitter taken down December 18th 2009
Attack attributed eventually to cyber-crime/vigilante
group named Iranian Cyber Army
Until December 2009 there was no group known as
Iranian Cyber Army...
BUT - Ashiyane (Shiite group) is from the same place
as the Iranian Cyber Army
44. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 44
45. All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
45
Iran-Twitter - Ashiyane
Ashiyane was using the same pro-Hezbolla
messages that were used on the Twitter
attack with their own attacks for some
time...
AND the Iranian Cyber Army seems to be
a pretty active group on the Ashiyane
forums www.ashiyane.com/forum
Lets take a quick look at how Ashiyane operates...
46. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 46
On [Crime|War] training
Ashiyane forums
WarGames
46
47. All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
47
47
Wargames targets includes:
48. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 48
Back to linking [Crime|War]
What else happened on the 18th?
More recently - Baidu taken down
with the same MO (credentials)
49. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 49
Ashiyane
Iranian Cyber
Army
DDoS
Botnet
Herding
Site
Defacement
Credit Card
Theft
Strategic
Attacks
Mapping Irans [Crime|War]
Iran
Iraq
US
$$ UK
US CN
Crime
War
50. All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
50
Iran - the unspoken
Stuxnet
There, Ive said it
51. Yoram Golandsky | November 2010
All rights reserved to Security Art ltd. 2002-2010 51
The Future (Ilustrated)
CLOUDS
52. All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
52
Summary
Good Bad
Formal training on
cybersecurity by nations
Commercial
development of malware
still reigns
Ugly
Good meet Bad: money changes hands,
less tracks to cover, criminal ops already
creating the weapons...
53. All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
53
Summary
The Future
Lack of legislation and cooperation on multi-national level
is creating de-facto safe haven for cybercrime. <- FIx
this!
Treaties and anti-crime activities may prove to be
beneficial. <- nukes? (i.e. treaties...)
54. All rights reserved to Security Art ltd. 2002-2010
Yoram Golandsky | November 2010
54
Thanks!
www.security-art.com
yoram@security-art.com
twitter.com/securityart
blog.security-art.com
Editor's Notes
#18: Who are the major players in Cyberwarfare now?
#20: GRU is very much like the American DIA (Defense Intelligence Agency) - collecting HUMINT, SIGINT, IMINT, and actively operating in technical espionage, as well as OSINT.
The SVR is working closely with the GRU
FSB is working closely with SVR (focused on domestic espionage)
CRMSF - I shit you not! Its an official russian government entity
#26: Completely financially motivated
Read: no political affiliation, unless $$$
Highly connected
Transactions can be traced across organizations
Hierarchical in nature
Need to know basis, highly professional business units, many small profit centers
#31: Highly sophisticated botnets
Usually rented by the hour/day for spamming or DDOS
Harvesting specific information (credit cards, financial data, personal information, emails, documents, applications, credentials, etc...)
#36: Engulfed in fog... information & dis-information all over the place.
Events:
Cast Led and 2nd Lebanon war
kinetic and cyber links hard to find
Palestinian TV station hacked for propaganda
Maybe? - Syrian nuclear facility bombing in 2007 (no proof - no radar accountability of ANY aircraft in the area...)
#38: McColo, ESTDomains, Atrivo and RBN are all connected one way or another to the government (FSB)
#47: At the Ashiyane forums, theres an ongoing contest called WarGames:
Sites are being targeted, participants are called to attack them - SQL injections, data theft, defacement, anything goes...
#52: Landscape highly unclear!
Where does that put developing nations
Africa? OLPC + zero enforcement of licensing = largest infected PC population in the world!
Arms race is on. Government/military commissioned attacks more likely, but mainly surgical strikes
No Cybergeddon for you so far (sorry CNN...)
Massive connectivity is still the WMD of CyberWar (and is a commodity)
No problem getting it from questionable arms dealers (bot herders) - just like we do now with conventional weapons....
#53: The Good Formal training on cybersecurity by nationsThe Bad Commercial development of malicious computer software (weapons manufacturers)The Ugly Good meets Bad - money changes hands, less tracks to cover (politically), criminal organizations already manufacturing arms...The Future Lack of legislation and cooperation on multi-national level is creating de-facto safe haven for cybercrime. Treaties and anti-crime activities may prove to be beneficial.