Cyberattacks and e-espionage threats to U.S. defense networks

Internet

The globalization of the Internet has spawned a rash of cyberattacks on the U.S. Department of Defense and a number of its contractors. One such example was the Poison Ivy attack on Booz Allen Hamilton, which was designed to pull sensitive data out of the company's computer network via an email attachment (Grow, Epstein & Tschang, 2008). Poison Ivy, along with other trojans and viruses, represents a new class of e-espionage, one that threatens the security of the United States. The Internet cat cannot be put back into the bag -- it has gone global and we are past the point of debating the merits of that. The real issue is how the United States can deal with these threats.

The Department of Defense created the Internet as a communications tools, and it has reshaped the world in many ways. Its usage is commonplace for the transmission of information. While initially the Internet may have been a safe means of transmitting information, once it was opened up to the world it has become an increasing source of risk -- and opportunity -- for America. Hackers routinely attempt to gain access to sensitive information using the Internet. They use deficiencies in major software platforms such as Microsoft's Outlook and Internet Explorer to plant viruses and gain access to sensitive information. This is possible because both in the Department of Defense and in its numerous contractors the use of email and Internet browsers is commonplace. Even if weak software such as Internet Explorer is not used directly to access sensitive information, it can still provide a pathway for a virus to enter a computer or a network. The information is then accessed via the virus. Callaham (2012) notes that Internet Explorer is particularly vulnerable to such attacks. The German government has even called for its citizens to avoid the browser because of its security holes (Richmond, 2012).

In a report aimed at its corporate clients, Price Waterhouse Coopers outlined the threat that e-spionage, as electronic espionage is known, poses to its clients. It defines e-spionage as "unauthorized and usually criminal access to confidential systems and information for the purpose of gaining a commercial or political advantage." The threat apparently comes from multiple different quarters, not just China but other nations as well that are seeking to benefit from access to classified information (PWC, n.d.)

Hacking

Poison Ivy represents one of the more serious hacking threats in recent years. Grow et al. (2008) note that it can be delivered via email attachment, and it is also known to be disseminated via Internet Explorer. The authors note that the United States has become victim to an "unprecedented rash of similar cyberattacks" since 2006. In 2007, for example, there were nearly 13,000 cybersecurity incidents reported by government agencies to the Department of Homeland Security. At least seven U.S. government agencies and a host of defense contractors have been targeted specifically in attempts to gain access to sensitive information.

The People's Republic of China has long been considered a major cybersecurity threat. The state sponsors professional hackers and has them employed to gather data from around the world. A number of intrusions have been tracked to the PRC in recent years. In true espionage fashion, the Chinese admit no wrongdoing, but nor would they. The Chinese government was implicated in hacking attacks on the Tibetan government-in-exile, for example, and is known to have hacked into sensitive networks in India, South Korea, Japan and the U.S. (Chaudhury, 2009).

Poison Ivy is one example of such a threat. The trojan's code was embedded in a routine email attachment, such that when the attachment was opened the virus would have been introduced to Booz Allen's secure network. Poison Ivy would not only gather information, but leave open a back door allowing the transmission of that information back to the virus' originators. This threat was caught because it was relatively unsophisticated, but these types of threats work when performed on a mass scale. Within any organization, there will always be somebody who makes a mistake and when that occurs the virus begins to do its work. Harley (2009) notes that there are even more sophisticated threats now. A technique known as 'spearfishing' embeds a virus or trojan within an otherwise innocuous .doc or .pdf file. These file types are not considered by users to be threats, so the risk that the file will be opened and the virus introduced to the system is far greater using this technique.

The virus threat is also an opportunity. The U.S. And Israel allegedly created the Stuxnet virus in order to slow down the progress of the Iranian nuclear program. This virus disabled much of that country's nuclear infrastructure. The attack was successful in disabling a number of centrifuges, but the virus escaped and caused damage to networks in other countries as well (Nakashima & Warrick, 2012). The use of e-spionage is something that works both ways. The Department of Defense originally felt that it would always have the upper hand in the use of e-spionage, but reportedly the Chinese threat has the rethinking that position and questioning if they have "created a monster." (Grow, et al., 2008).

China in particular poses a threat because of its capabilities. Drawing on its massive population and modern technological capabilities, China has the ability to employ up to 40,000 hackers to work on a variety of projects, from building new virus and trojan threats to finding creative ways to deliver those threats to targets. The United States has excellent capacity for e-spionage as well, but some of its best talent will be diverted to the private sector, something that China does not have to worry about as much, given the limited number of great opportunities in that country for similarly-talented individuals, and the totalitarian nature of the government.

Conclusion

If we are to evaluate whether the globalization of the Internet has been good or bad, it has been overwhelmingly good. It has allowed the United States unprecedented technological and economic gains to cement the nation's superior status for years to come. The United States also has incredible capabilities with respect to e-spionage. The country cannot simply arrive at the conclusion that because it is not the only player in the game that the game is inherently bad -- such a view is patently absurd. The reality is that there are just as many opportunities as there are threats. There are as many Stuxnets as there are Poison Ivies. The key to defending against attacks like the Poison Ivy attack against Booz Allen is to understand the risks, and ensure that the U.S. stays one step ahead of the hackers. This is not easy, but the DoD could not have possibly thought it would be.

Proper defenses, enhanced offensive capabilities and strategies to reduce risk by taking some sensitive data offline will all work to deliver better results in e-spionage of the United States. The Internet has become globalized, and nothing can take that back. That there are threats as the result of globalization is nothing new -- it is simply another arena for age-old international political traditions. How we manage the threats and take advantage of the opportunities is the most important aspect to this problem -- and this means proper isolating and neutralizing of viral threats. By addressing the issue of e-spionage effectively, the Internet can still be viewed as a net benefit for the United States.

Works Cited:

Callaham, J. (2012). New Internet Explorer vulnerability used to deliver "Poison Ivy" trojan. Neowin.net. Retrieved November 30, 2012 from http://www.neowin.net/news/new-internet-explorer-vulnerability-used-to-deliver-poison-ivy-trojan

Grow, B., Epstein, K. & Tschang, C. (2008). The new e-espionage threat. Business Week. Retrieved November 30, 2012 from http://www.businessweek.com/stories/2008-04-09/the-new-e-spionage-threat

Richmond, S. (2012). German government warns users off Internet Explorer. The Telegraph. Retrieved November 30, 2012 from http://www.telegraph.co.uk/technology/microsoft/9552462/German-government-warns-users-off-Internet-Explorer.html

Chaudhury, D. (2009). China's e-spionage. India Today. Retrieved November 30, 2012 from http://indiatoday.intoday.in/story/China%C3%A2%E2%82%AC%E2%84%A2s+e-espionage/1/34510.html

PWC. (n.d.) E-espionage: What risks does your organization face from cyber-attacks? Price Waterhouse Coopers. Retrieved November 30, 2012 from http://www.pwc.com/us/en/it-risk-security/assets/e-espionage.pdf

Harley, D. (2009). Chinese whispers: Targeted malware and e-espionage. ESET Threat Blog. Retrieved November 30, 2012 from http://blog.eset.com/2009/03/29/chinese-whispers-targeted-malware-and-e-espionage

Nakashima, E. & Warrick, J. (2012). Stuxnet was the work of U.S. And Israeli experts, officials say. Washington Post. Retrieved November 30, 2012 from http://www.washingtonpost.com/world/national-security/stuxnet-was-work-of-us-and-israeli-experts-officials-say/2012/06/01/gJQAlnEy6U_story.html