Inside cyber warfare: mapping the cyber underworld

350 Pages·2009·4.18 MB·English

by  Jeffrey Carr

Inside Cyber Warfare
Jeffrey Carr
Editor
Mike Loukides
Copyright © 2009 Jeffrey Carr
This book uses RepKover™, a durable and flexible lay-flat
binding.
O’Reilly books may be purchased for educational, business, or
sales promotional use. Online editions are also available for
most titles (http://my.safaribooksonline.com). For more
information, contact our corporate/institutional sales
department: [phone] or [email protected].
Nutshell Handbook, the Nutshell Handbook logo, and the
O’Reilly logo are registered trademarks of O’Reilly Media, Inc.
Inside Cyber Warfare, the image of light cavalry, and related
trade dress are trademarks of O’Reilly Media, Inc.
Many of the designations used by manufacturers and sellers to
distinguish their products are claimed as trademarks. Where
those designations appear in this book, and O’Reilly Media, Inc.
was aware of a trademark claim, the designations have been
printed in caps or initial caps.
While every precaution has been taken in the preparation of
this book, the publisher and author assume no responsibility
for errors or omissions, or for damages resulting from the use
of the information contained herein.
O'Reilly Media
Foreword
Lewis Microsoft Institute for Advanced Technology in
Governments Shepherd
Chief Technology Officer and Senior Fellow,
Microsoft Institute for Advanced Technology in Governments
Senior Technology Officer, Defense Intelligence Agency (2004–2007)
During his campaign for reelection in 1996, the Internet-savvy
President Bill Clinton used the slogan “Building a Bridge to the
21st Century.” It turns out that the bridge is operated and
maintained in cyber form, and that malevolent actors can
practice their black arts to disrupt or destroy the bridge, its
cyber traffic, and all who rely upon it. And although it is
disturbingly clear that the bridge to the 21st century can be
taken out, it is even more clear that we don’t always know by
whom or why.
Jeffrey Carr’s Inside Cyber Warfare explores the factual
background of why that is so, who the actors are (and their
motivations) and the likely future course of cyber warfare in all
its manifestations. In part, this book’s value is the
comprehensiveness of its coverage, across the spectrum of
militarized or warlike computer network operations (CNO).
New students of the field—and there are many, in academia,
government, and private industry—will benefit from the clear
explication of the divisions between computer network defense,
computer network exploitation, and computer network attack.
Examples abound of each, described in dispassionate, factual
prose more helpful than the sometimes frightening headline
media coverage of isolated events.
Experts in the field of cyber warfare and CNO will find that
these pages are required reading, for Jeffrey Carr has applied
an evidentiary analytical framework to understanding the
intricacies that distinguish state and non-state actors and
hackers, and the varying but discoverable mosaic of political,
economic, and social motivations that incentivize cyber
warfare.
I first became aware of Jeffrey Carr and his expertise while
serving in the intelligence community, where like others, I
relied on his much-read-within-the-Beltway blog Intelfusion.
For this book, Carr’s background is ideal: an early career at the
world’s leading software and technology company (Microsoft),
his entrepreneurial founding of the highly regarded Project
Grey Goose (which I have advised), and the activities of his
GreyLogic organization. He now adds to that list the title of
“authority,” with its imprimatur stamped by virtue of the pages
in this book.
Military analysts, pundits, and warfighters alike have known
for centuries the Latin adage attributed to “the Roman Sun
Tzu,” Publius Flavius Vegetius Renatus, famous for his “art-of-
war” classic from 390 BC, De Re Militari: “Si vis pacem, para
bellum”; if you wish peace, prepare for war. Inside Cyber
Warfare is the necessary handbook for a new 21st century in
which all who hope for the new world of cyber-powered
peaceful interactions must prepare for cyber war.
Preface
I was recently invited to participate in a cyber security dinner
discussion by a few members of a well-known Washington D.C.
think tank. The idea was that we could enjoy a fine wine and a
delicious meal while allowing our hosts to pick our brains about
this “cyber warfare stuff.” It seems that the new threatscape
emerging in cyberspace has caught them unprepared and they
were hoping we could help them grasp some of the essentials
in a couple of hours. By the time we had finished dinner and
two bottles of a wonderful 2003 red, one of the Fellows in
attendance was holding his head in his hands, and it wasn’t
because of the wine.
International acts of cyber conflict (commonly but inaccurately
referred to as cyber warfare) are intricately enmeshed with
cyber crime, cyber security, cyber terrorism, and cyber
espionage. That web of interconnections complicates finding
solutions because governments have assigned different areas
of responsibility to different agencies which historically do not
play well with others. Then there is the matter of political will.
When I signed the contract to write this book, President Obama
had committed to make cyber security a top priority in his
administration. Seven months later, as I write this introduction,
cyber security has been pushed down the priority ladder
behind the economy and health care, and the position of cyber
coordinator, who originally was going to report directly to the
President, must now answer to multiple bosses with their own
agendas. A lot of highly qualified candidates have simply
walked away from a position that has become a shadow of its
former self. Consequently, we all find ourselves holding our
heads in our hands more often than not.
Cyberspace as a warfighting domain is a very challenging
concept. The temptation to classify it as just another domain,
like air, land, sea, and space, is frequently the first mistake
that’s made by our military and political leaders and policy
makers.
I think that a more accurate analogy can be found in the realm
of science fiction’s parallel universes–—mysterious, invisible
realms existing in parallel to the physical world, but able to
influence it in countless ways. Although that’s more metaphor
than reality, we need to change the habit of thinking about
cyberspace as if it’s the same thing as “meat” space.
After all, the term “cyberspace” was first coined by a science
fiction writer. My own childhood love affair with science fiction
predated William Gibson’s 1984 novel Neuromancer, going all
the way back to The New Tom Swift Jr. Adventures series,
which was the follow-up to the original series of the early
1900s. By some quirk of fate, the first Tom Swift Jr. book was
published in 1954 (the year that I was born) and ceased
publication in 1971 (the year that I left home for college).
Although the young inventor didn’t have cyberspace to contend
with, he did have the “Atomic Earth Blaster” and the “Diving
Sea Copter.” In an otherwise awful childhood, the adventures
of Tom Swift Jr. kept me feeling sane, safe, and excited about
the future until I was old enough to leave home and embark on
my own adventures.
Now, 38 years later, I find myself investigating a realm that
remains a sci-fi mystery to many leaders and policy makers of
my generation, while younger people who have grown up with
computers, virtual reality, and online interactions of all kinds
are perfectly comfortable with it. For this reason, I predict that
the warfighting domain of cyberspace won’t truly find its own
for another five to eight years, when military officers who have
grown up with a foot in both worlds rise to senior leadership
roles within the Department of Defense.
How This Book Came to Be
This book exists because of an open source intelligence
(OSINT) experiment that I launched on August 22, 2008,
named Project Grey Goose (Figure 1). On August 8, 2008, while
the world was tuning in to the Beijing Olympics, elements of
the Russian Federation (RF) Armed Forces invaded the nation
of Georgia in a purported self-defense action against Georgian
aggression. What made this interesting to me was the fact that
a cyber component preceded the invasion by a few weeks, and
then a second, much larger wave of cyber attacks was launched
against Georgian government websites within 24 hours of the
invasion date. These cyber attacks gave the appearance of
being entirely spontaneous, an act of support by Russian
“hacktivists” who were not part of the RF military. Other
bloggers and press reports supported that view, and pointed to
the Estonian cyber attacks in 2007 as an example. In fact, that
was not only untrue, but it demonstrated such shallow
historical analysis of comparable events that I found myself
becoming more and more intrigued by the pattern that was
emerging. There were at least four other examples of cyber
attacks timed with RF military actions dating back to 2002.
Why wasn’t anyone exploring that, I wondered?
Figure 1. The official logo of Project Grey Goose
I began posting what I discovered to my blog IntelFusion.net,
and eventually it caught the attention of a forward deployed
intelligence analyst working at one of the three-letter agencies.
By “forward deployed” I refer to those analysts who are under
contract to private firms but working inside the agencies. In
this case, his employer was Palantir Technologies. “Adam” (not
his real name) had been a long-time subscriber to my blog and
was as interested in the goings-on in Georgia as I was. He
offered me the free use of the Palantir analytic platform for my
analysis.
After several emails and a bunch of questions on my part, along
with my growing frustration at the overall coverage of what
was being played out in real time in the North Caucasus, I
flashed on a solution. What would happen if I could engage
some of the best people inside and outside of government to
work on this issue without any restrictions, department
politics, or bureaucratic red tape? Provide some basic
guidance, a collaborate work space, and an analytic platform,
and let experienced professionals do what they do best? I loved
the idea. Adam loved it. His boss loved it.
On August 22, 2008, I announced via my blog and Twitter an
open call for volunteers for an OSINT experiment that I had
named Project Grey Goose. Prospective volunteers were asked
to show their interest by following a temporary Twitter alias
that I had created just for this enrollment. Within 24 hours, I
had almost 100 respondents consisting of college students,
software engineers, active duty military officers, intelligence
analysts, members of law enforcement, hackers, and a small
percentage of Internet-created personas who seemed to have
been invented just to see if they could get in (they didn’t). It
was an astounding display of interest, and it took a week for a
few colleagues and I to make the selections. We settled on 15
people, Palantir provided us with some training on their
platform, and the project was underway. Our Phase I report
was produced about 45 days later. A follow-up report was
produced in April 2009. This book pulls from some of the data
that we collected and reported on, plus it contains quite a bit of
new data that has not been published before.
A lot has happened between April 2009 and September 2009,
when the bulk of my writing for this book was done. As more
and more data is moved to the Cloud and the popularity of
social networks continues to grow, the accompanying risks of
espionage and adversary targeting grow as well. While our
increasingly connected world does manage to break down
barriers and increase cross border friendships and new
understandings, the same geopolitical politics and national self
interests that breed conflicts and wars remain. Conflict
continues to be an extension of political will, and now conflict
has a new domain upon which its many forms can engage
(espionage, terrorism, attacks, extortion, disruption).
This book attempts to cover a very broad topic with sufficient
depth to be informative and interesting without becoming too
technically challenging. In fact, there is no shortage of
technical books written about hackers, Internet architecture,
website vulnerabilities, traffic routing, etc. My goal with this
book is to demonstrate how much more there is to know about
a cyber attack than simply what comprises its payload.
Welcome to the new world of cyber warfare.
Conventions Used in This Book
The following typographical conventions are used in this book:
Italic
Indicates new terms, URLs, email addresses, filenames, and
file extensions.
Constant width
Used for queries.
Constant width italic
Shows text that should be replaced with user-supplied values
or by values determined by context.
Note
This icon signifies a tip, suggestion, or general note.