Kaspersky Says Cyber Weapons "Cleaner" Than Traditional Weapons But "Much Worse" 89
DavidGilbert99 writes "Eugene Kaspersky and Mikko Hypponen have been watching the cyber security world every since happy hackers were writing viruses for nothing more than their own entertainment. Today however things are very much different. At the DLD 2013 conference, the pair debated the current state of cyber warfare and cyber weapons. Kaspersky said that while cyber weapons may be much 'cleaner' than traditional missiles, guns and bombs, they are 'much worse' as they can be used by just about anyone who has some level of computer proficiency. Both agreed that it was very difficult to protect against the highly-complex nation-state developed malware like Stuxnet, Flame and Gauss. Hypponen said that we are in the 'first stages of a cyber-arms race' warning: 'I think we've only seen the very beginning of these problems.'"
Depends on the size of the gun (Score:1)
Excluding still-hypothetical malware which takes control of hardware that can decimate the human population or does something that causes a human to do the same, about the worst that malware can do is maybe knock a few planes out of the sky, disable a few cities' water supplies, etc. until we decide we no longer trust technology. At that point we'll be back to the 1950s, at worst.
We've had enough bombs to send the human race back to the per-industrial age if not to extinction for over 40 years now.
So, yeah
Re: (Score:2)
I'd say we end up back at the 1980s or early 1990s where companies had internal networks and did NOT connect them to the Internet. In fact, a lot didn't use IP, so bridging them would be difficult (doable, but hard).
Re: (Score:1)
Anonymous (Score:2)
Sounds too much like the recent Battelstar Glactica reboot to me...
Anonymous evolved...and They Have No Plan
Re: (Score:2)
Contrary to popular belief a lot of the critical computing infrastructure is not connected to the Internet. For example if you want to infiltrate one of the major oil and gas pipelines control systems will require some physical access to the system and physically infiltrating even a slightly guarded computing facility is not for the faint hearted. Even the Stuxnet virus required physical access to a USB port on the physical network and infiltrating a nations nuclear research facilities can be a bit tricky.
Re: (Score:2)
Re: (Score:2)
Those were pretty much my thoughts. Kaspersky and company simply take themselves to seriously. I'd be upset if computers stopped working tomorrow, but I'd get over it. Withdrawal pains would only last several days, or a few weeks.
Now, bombs are a whole different story. Most people don't get over it. And, arguably, the ones who die are the lucky ones.
Re: (Score:2)
I'd be upset if computers stopped working tomorrow, but I'd get over it. Withdrawal pains would only last several days, or a few weeks.
Methinks you have no idea whatsoever what computers do in our world. I'm not sure whether to start the list with the ones that keep our cars and highways operational, or the ones which currently hold all your money (unless you actually are one of those "gold bar in the mattress" folks).
Re: (Score:2)
We can adapt. People can learn to count change again, instead of relying on computers. People can learn to write and take notes again, to mail letters. Banks can just go to all the trouble of sorting out our finances, manually, again. Everything that is done by computer today, was done manually as recently as twenty years ago. People might bitch. Businesses might bitch. The government might bitch. But, we could, and we would, sort it all out.
Computers are cool, I like them. People are stupid, and r
Re: (Score:2)
None the less, to say cyber warfare is wors
Re: (Score:3)
Cyberweapons aren't going to stop all or even most of our computers from working. As for the computers that hold our money, the bankers and their friends have probably lost more
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Either that or it would be awesome [therpgsite.com].
I'm keeping an eye on that!
not worse (Score:5, Interesting)
defacing websites? taking down SCADA systems of those stupid enough to internet connect them? who has died as direct result of cyber crime?
Re:not worse (Score:5, Funny)
Most people would rather die than lose the ability to watch cat videos on YouTube.
Re: (Score:2)
In that case you need a really really secure password for your internet-connected critical systems. I Suggest "Kaboom".
Re: (Score:2)
I just use the tried and true password 12345 on my luggage.
Re: (Score:1)
Re: (Score:2)
nonsense, the very worst you can do "hacking" a nuclear power plant is trip the reactor offline. that's even the worst that can happen if terrorists take over the contorl room. why? because their are safety systems OUTSIDE the realm of computer controlled systems that are mandated. sorry about your TV and Hollywood fueled fantasies, but having been engineer in the field reality is you cause inconvenience and that's all.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
This is utter nonsense. Not the risks, just your rather specific description of the problem.
Re: (Score:2)
You were saying?
Re: (Score:2)
You accused them of planting logic bombs. The article claims they've been mapping our power grids.
You can bet the US has mapped their power grids to the best of their abilities to do so. Is this an example of American global pre-eminence or are you just going to admit that you are talking out of your ass, citing a Telegraph article which is also talking out of its ass?
Re: (Score:2)
http://online.wsj.com/article/SB123914805204099085.html [wsj.com]
Re: (Score:2)
The WSJ, the bastion of journalistic integrity. At least this article succeeded in rousing simpletons to arms with FUD- just as it had intended.
There is not one iota of fact in here, the only fact being the number of weasel words, such as "could", "might", "in the event of", and other further unlikely prognostications based on a simplistic understanding of command and control infrastructure, how it is connected to the Internet, and just how interested some parties (aka frenemies) are in subverting it.
Re: (Score:2)
Re: (Score:2)
http://www.telegraph.co.uk/news/worldnews/asia/china/5126584/China-and-Russia-hack-into-US-power-grid.html [telegraph.co.uk]
Re: (Score:2)
false, china did not make the generators, U.S. and Japanese companies did
Re: (Score:2)
Re: (Score:2)
companies such as siemens have plants in India and China, sure, but look where else they have plants to make generators and turbines, etc. USA, Europe, south america...
Re:not worse (Score:5, Insightful)
It's not just Internet-connected infrastructure. In many cases, people took the proper precautionary steps, but weren't actively paranoid. To protect your infrastructure today, you really do need to be paranoid. People bring in gadgets infected with malware, plug the malware-infected gadget into a PC, and the PC infects every system on the network. OK, so you ban people from bringing in gadgets, and now you remove all secretarial PCs from the main network. Maybe you even disable every USB port and force people to use PS/2 keyboards and mice. Well, the next infection comes in from a contractor who installs software directly from the manufacturer. If the hackers know that you use Flash and/or Java in your company's intranet, it's not inconceivable that they manage to infect Flash or Java. I mean, we're talking about nation states here. They can do whatever the fuck they want, and money is not much of an issue.
Somewhere along the line, people with resources a hundred times greater than yours will come up with a line of attack that you didn't defend against. And if you protect against everything obvious, who knows what the crazy fuckers will do? If I were on the Iranian nuclear power commission, I'd probably give the Americans and Israelis a semi-obvious backdoor to my network, just so that they don't send in black ops teams. I'm not saying that I think the Americans and Israelis would be so stupid, but, then again, these people probably grew up watching James Bond movies. They probably think that shit is exciting.
Anything closed source is suspect. (Score:2)
It's not just Internet-connected infrastructure. In many cases, people took the proper precautionary steps, but weren't actively paranoid. To protect your infrastructure today, you really do need to be paranoid. People bring in gadgets infected with malware, plug the malware-infected gadget into a PC, and the PC infects every system on the network. OK, so you ban people from bringing in gadgets, and now you remove all secretarial PCs from the main network. Maybe you even disable every USB port and force people to use PS/2 keyboards and mice. Well, the next infection comes in from a contractor who installs software directly from the manufacturer. If the hackers know that you use Flash and/or Java in your company's intranet, it's not inconceivable that they manage to infect Flash or Java. I mean, we're talking about nation states here. They can do whatever the fuck they want, and money is not much of an issue.
Somewhere along the line, people with resources a hundred times greater than yours will come up with a line of attack that you didn't defend against. And if you protect against everything obvious, who knows what the crazy fuckers will do? If I were on the Iranian nuclear power commission, I'd probably give the Americans and Israelis a semi-obvious backdoor to my network, just so that they don't send in black ops teams. I'm not saying that I think the Americans and Israelis would be so stupid, but, then again, these people probably grew up watching James Bond movies. They probably think that shit is exciting.
If you can't inspect the source code and the compiler then it could very well be suspect. A backdoor in the compiler itself is all it takes to put a backdoor on everything compiled with that compiler. How would you defend against that?
Anything open source is suspect. (Score:1)
Unless you're, line by line, going through every line of code - code you're compiling yourself, having safely built the compiler yourself, you're not preventing anything.
"But everybody's looking at it! Open source man!"
Said everybody who failed to notice the numerous compromised repositories over the years.
Granted, having the ability to do that - despite how painful and unlikely it is anybody will do it, is a good thing.
Re: (Score:2)
Re: (Score:2)
Who needs to insert a backdoor into Java? Isn't Java just one gigantic back door these days straight from Oracle?
Re: (Score:1)
Re: (Score:2)
true, but I was just giving specific examples. but again, who has died thus far? wouldn't "the terrorists" have done it if it were possible. reality is you cause inconvenience by messing with SCADA systems, the engineers already put in other safegaurds to any halfway well designed system. for example, "hack" a nuclear power plants systems (or even manually manipulate the controls in the control room) and the very worst you can do is trip the plant offline and piss of the stockholders for downtimes. tha
Re: (Score:2)
lose of water wouldn't happen for that long. my cousin used to work in the water works in large midwestern city, that shit can run with or without computers. in the suburb where I grew up, they still have the switches for the water work's pumps roped off, because they're fucking knife switches from the 1930s and you can electrocute yourself to death by touching the contacts. you can really hack those with your scada rootkit, NOT!
Scare Headlines Sell Products (Score:5, Insightful)
I am not surprised by Kapersky saying what he does.
If you don't want your automation system attacked, then keep it off line and what is off line monitored and limited so it can't be accessed improperly and then treat your crew right...with supervision.
Life is not easy.
Re: (Score:2)
Also, saying "cyber weapons can be used by anyone with some proficiency" is misleading. Sure, any script kiddy can send a virus to their friend, but there aren't many people who can figure out how to get Stuxnet on their enemy's SCADA system.
If anyone is interested, as far as I can tell, the primary securi
Re: (Score:2)
No kidding. Why doesn't Kaspersky tell the mothers of the couple hundred kids killed by drone strikes that cyber "weapons" are worse?
Re: (Score:1)
Because drones are just one of many human interfaces to cyber-weapons? What happens when one of those is hacked? Especially when the difference between one and a hundred is how many hosts you connect to. Far-fetched definitely, but a drone is almost by definition a hackable weapon system.
Re: (Score:2)
Fair enough. But what would the hackers do? Use them with reckless disregard for the safety of civilians? Oh wait.
The only reason we would care is if the hackers used them on white people as the US has been using them on brown people.
Re: (Score:1)
The U.S. so far has been using them in conflict with terrorists. Hackers/terrorists would be using them for crime or terrorism.
I know the arguments-- why is it different when the government does it? Why is it OK for the government to do it? Why is it OK that they're killing civilians? Women? Kids? And so on, ad infinitum.
The difference is that they're (currently) being used in a "war" against a non-nation state. There are civilian and innocent casualties in all conflicts, but the casualties so far have been
Re: (Score:2)
You're making valid points and I was with you until you said it has nothing to do with race or religion. The you lost me.
If it were white Christian or jewish civilians it would be so different. You have to be so naive or dishonest not to see that.
Re: (Score:1)
You're absolutely right that it would be different if they were white Christian or Jewish, I don't deny that. What I do deny though is that the attacks themselves are because they're brown. They're only less objectionable because they're brown. Welcome to racist America. :/
Re: (Score:2)
I am not surprised by Kapersky saying what he does.
Nor am I. After all, Kapersky should know all about the dangers of professionally written malware, since how he's been producing and distributing it for many years. How else can I characterize a closed-sourced package resistant to any kind of audit that claims to be an "antivirus" and gobbles up the resources to perform tasks on Kapersky's behalf?
This word 'worse'.. (Score:2)
Well, I guess it comes down to what criteria one means when one says 'worse'. In terms of ease of access or ability to defend against it might be 'worse'.. but worse in the same way that, say, pigeon crap is worse. Sure it might be everywhere and you can't do much about its absolute existence, but you can do a LOT against it actually doing harm.
One can not do much to 'defend' against cyber weapons on the whole, but one can do a lot to mitigate the impac
Re: (Score:2)
I think he means "potentially bad for him". I mean, if some bad guys over in Afghanistan have AK-47s or IEDs, sure some soldiers are going to get wounded or killed, but Kaspersky will be sitting quite comfortably at home. But if a cyberweapon hits a company that happens to be one of his major stock holdings, that could severely hamper production for a couple of days, lowering the stock price and costing Kaspersky significant amounts of cash.
Same story with the many many people who think that the US, the UK,
Re: (Score:2)
On the other end, there is the idea that poverty kills and thus things that cause mass economic damager really do hurt people and cause shortened lifespans.. but I have yet to hear of any cyber attack that even begins to approach that and, if we were going to use that metric, the people who create AI systems for stock trading would be in far more legal trouble then even the worst cyber criminals.
Cyber Weapons? (Score:1)
You mean those things that can attack Windows systems?
STOP USING MICROSOFT PRODUCTS!
Re: (Score:2)
CEO: the world desperately needs my products (Score:1)
OMG folks, the scenarios are far more dangerous than those involving nuclear and biological weapons!
Hoo-kay Mr Kaspersky.
Professional malware (Score:1)
About twenty years ago people were writing malware mostly because they could. I was working on a well known (at the time) product and one day someone joked that we write a virus that targeted our main competitor's product. This led to a serious discussion of what could happen if a team like ours of about 25 experienced professional programmers started writing viruses. It was not a pretty picture.
We now live in this world with Stuxnet/Flame/etc. It is even scarier now than it was tthen.
Where are we on the gunpowder scale? (Score:5, Interesting)
I wonder where we are on that scale with weaponizable viruses. Are Stuxnet and its peers the equivalent of Predator drones or will we look back decades from now and think that they were the crude matchlock blunderbusses of their day?
Re: (Score:2)
Wait, wait, I've seen this one. It always starts with Arnold always been sent back in time right?
Just about anyone. (Score:3, Insightful)
they are 'much worse' as they can be used by just about anyone who has some level of computer proficiency. Both agreed that it was very difficult to protect against the highly-complex nation-state developed malware like Stuxnet, Flame and Gauss.
Um, nation-states are not "just about anyone". They actually tend to be the same people who have all those "dirty" traditional weapons too. Sure, in theory some rogue basement dweller could launch a massive cyber attack just before his mother calls him up for dinner, but in general such attacks build on information gathered by intelligence services and the State Department (you need to know what you are targeting to do it efficiently).
The fact that such dire warnings come from someone who just happens to profit from the existence and above all fear of malware makes it a little hard for me to take it as seriously as he apparently does.
Incidentally, if some basement dweller on the other side of the planet really does pose a threat to your national security, you need to fire the clowns who set up your IT infrastructure and hire some people who actually know wtf they are doing. Stay on top of exploits, keep your software and patchsets up-to-date, plug the holes in your firewalls, don't do stupid things like plaintext storage of passwords anywhere, force the use of keys where possible, etc... you know, all the basic stuff that gets discussed whenever security comes up. Most successful attacks that make the news are not examples of very clever attackers but rather abysmally unaware defenders.
Maybe I don't know what I'm talking about, but from here it looks like someone complaining that they're car might get stolen because they keep leaving it running with the doors open in a busy part of town with no police or cameras. "Omg auto theft is likely to go up and people will be run over by inexperienced/drunk/high drivers who shouldn't be behind the wheel, we must do something!" Yeah, park it in a better spot, turn of the engine, take the keys out of the ignition, lock the door, and come back to check on it at least once a day. Derp.
Re: (Score:2)
they are 'much worse' as they can be used by just about anyone who has some level of computer proficiency. Both agreed that it was very difficult to protect against the highly-complex nation-state developed malware like Stuxnet, Flame and Gauss.
Um, nation-states are not "just about anyone". They actually tend to be the same people who have all those "dirty" traditional weapons too. Sure, in theory some rogue basement dweller could launch a massive cyber attack just before his mother calls him up for dinner, but in general such attacks build on information gathered by intelligence services and the State Department (you need to know what you are targeting to do it efficiently).
The fact that such dire warnings come from someone who just happens to profit from the existence and above all fear of malware makes it a little hard for me to take it as seriously as he apparently does.
Incidentally, if some basement dweller on the other side of the planet really does pose a threat to your national security, you need to fire the clowns who set up your IT infrastructure and hire some people who actually know wtf they are doing. Stay on top of exploits, keep your software and patchsets up-to-date, plug the holes in your firewalls, don't do stupid things like plaintext storage of passwords anywhere, force the use of keys where possible, etc... you know, all the basic stuff that gets discussed whenever security comes up. Most successful attacks that make the news are not examples of very clever attackers but rather abysmally unaware defenders.
Maybe I don't know what I'm talking about, but from here it looks like someone complaining that they're car might get stolen because they keep leaving it running with the doors open in a busy part of town with no police or cameras. "Omg auto theft is likely to go up and people will be run over by inexperienced/drunk/high drivers who shouldn't be behind the wheel, we must do something!" Yeah, park it in a better spot, turn of the engine, take the keys out of the ignition, lock the door, and come back to check on it at least once a day. Derp.
Who they use to launch the attack isn't necessarily the people who you would expect. Anyone could be used to launched the attack but the code could be written by the military. Or it could be the other way around where the military contracts anyone to write the code but then uses it's people. It's impossible know who is what or who does what.
Well... (Score:2)
Re: (Score:2)
If you're infrastructure (beyond just computers) is capable of being hacked then you're not designing your infrastructure properly
Yes, but what if your CAD software gets hacked?
It all depends from what you sell. (Score:2)
Self serving, corrupt ass (he and his ex) (Score:2)
Surprising eh- such a quote from someone who hangs with the FSB and is busy drumming up business for he and his ex? He's also argued this as the motivation behind his call for a complete lack of transparency and privacy for average citizens including the need for government provided authentication as a "protection". He's a self-serving corrupt ass using his money and influence to impose his and his friends will on anyone he can. He (along with the internet braintrust represented by Russia, the UAE, China,
Ban cyberweapons and only criminals will have them (Score:2)
Hypponen added that what set cyber-weapons apart from traditional weapons was the fact that anyone could get their hands on one of these weapons, unlike a nuclear bomb, missiles or tanks which only armies would have access to.
Regular people can't get ahold of traditional weapons? What? Isn't that a large part of what most of the US (and the peanut gallery around the world) has been arguing about for the last month? That people can get their hands on the terrible traditional weapons?
So why don't "they" (go as far up the chain as need be) just outlaw cyber-weapons around the world. Seems like that would take care of the whole problem... or does that only apply to computers... or neither? And do you think "they" would be sc
Limit the size of data packets (Score:2)
Military uses packet sizes of 1500 bytes. We should limit the packet sizes for TCP to 768 bytes for civilian (non law-enforcement) use. Law-enforcement can use 1500 byte packets only after going through special training. This will help mitigate the threat posed by cyber warfare - and it makes as much sense as any other policy being proposed.
Mini fix (Score:2)
Mikko Hypponen
Ahem...the other dude's name is Mikko Hyppönen.
(comicbookguy-voice) Worst, summary, ever.
Re: (Score:2)
Didn't you hear? He got approved for a second umlaut. His name is now: Mikkö Hyppönen
Kaspersky (Score:1)
Kaspersky really should stop pretending to know anything other than DOS and Windows malware. "Cyber weapons" exploit easily avoidable vulnerabilities, that exist because companies responsible for infrastructure-critical software are incompetent and greedy. Stop filling the market with overpriced hastily built crap, and there would be no "evil hackers" to speak about.