Forgot your password?
typodupeerror
Security The Military

How the Code War Has Replaced the Cold War 79

Posted by Soulskill
from the time-to-update-the-rules-of-engagement dept.
An anonymous reader writes "After years on the defensive, governments are building their own offensive capabilities to deliver digital attacks against their enemies. It's all part of a secret arms race, where countries spend billions of dollars to create stockpiles of digital weapons and zero-day flaws. But is this making us any safer, or putting us and the internet at risk? 'Estonia is a small state with a population of just 1.3 million. However, it has a highly-developed online infrastructure, having invested heavily in e-government services, digital ID cards, and online banking. ... The attacks on Estonia were a turning point, proving that a digital bombardment could be used not just to derail a company or a website, but to attack a country. Since then, many nations have been scrambling to improve their digital defenses -- and their digital weapons. While the attacks on Estonia used relatively simple tools against a small target, bigger weapons are being built to take on some of the mightiest of targets.'"
This discussion has been archived. No new comments can be posted.

How the Code War Has Replaced the Cold War

Comments Filter:
  • by cold fjord (826450) on Friday April 25, 2014 @11:28PM (#46846455)

    Since they seem destined to exist I hope that the cyber weapons being built have adequate safeguards against their misuse or accidental use.

    Cyber warfare is worse than submarine warfare in terms of being able to identify an attacker. It provides the means for potentially anonymous devastating attacks. How will the world react to that?

    Cyber arms control will be difficult to achieve, at best, maybe impossible.

    Will a "Cyber Geneva Convention" be needed? No attacking hospitals, etc.?

    How will organized crime and black hats fit into this framework? Will they be in the new era what pirates were in the 1700s - 1800s?

    • We must not allow a byteshift gap!
    • Re: (Score:2, Insightful)

      by Anonymous Coward

      Anonymous attacks? The even worse part is that it is possible to make it look like it was someone else that started the attack by going via insecure third-party systems and covering your tracks.

      But sure, we can trust the reports stating that China is one of the major cyber war actors. Despite them having insecure systems and anonymous hosting that anyone in the world can abuse....

    • by Anonymous Coward

      Safeguards ? Like an Evil bit flag parser on my shellcode ?

  • wasn't so downright negligent in their race to adopt new technology, most of the problem would not exist.

    • by Anonymous Coward on Saturday April 26, 2014 @02:37AM (#46846855)

      It isn't adopting new technology, it is doing so focusing being as cheap as possible in the short term, and damn the long run.

      In reality, I see at least six things that, had it been implemented earlier, would have saved us a lot of issues:

      1: The concept of tainted instructions and having anything a Web browser grab be viewed as potentially hostile. This means add-ons are restricted to a sub-context and only can get keyboard input if they have the focus (and they have to be clicked on to have that happen), and the OS the Web browser sits on not just isolate its processes in memory, but also the file system. This way, there isn't an undocumented API a compromised browser or add-on could use to expand its context.

      2: Moronic things like the USB protocol where a disk drive can present itself as a keyboard. It would be nice to have specific USB ports where only drives can register in one set, keyboards in another set, and so on.

      3: The almighty firewall as the answer to all remote hacking. This worked when hacks were incoming, but now with the primary means of attack holes in Web browsers, the focus needs to be on add-ons and the browser, then defense in depth.

      4: Backups got set aside. It wasn't that long ago when every serious PC had a tape drive with it because hard disks died, and tape was cheap, and worked well. Now that people think they can back up to hard disks (note, none I know of are archival grade), it is a matter of course to lose data.

      5: Trusting other people with security. When people stopped packing their own parachutes, the shit hit the fan. If one wants to store stuff with an offshore provider, great. Just encrypt the damn files before they leave the site.

      6: Final one... no security specs or audits whatsoever except for the US Government's FISMA compliance that can have random audits happen. Only time an audit happens in a lot of private companies is after a breach happens.

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        7. Equating a running process with a user and assigning privilege accordingly - this is a massive fail. It was relevant back in the day when researchers logged on to shared systems and ran programs they had written themselves. It assumes a complete knowledge of the program to be run, which has not been the case for 30 years, but is still the standard level of trust.

  • Billions of dollars? (Score:5, Interesting)

    by c0d3g33k (102699) on Saturday April 26, 2014 @12:07AM (#46846551)

    Stockpiles of exploits? Sounds like some reporter is out of his/her depth and can't understand the difference between physical weapon stockpiles and software vulnerabilities. Welcome to the new Yellow Journalism. FUD, FUD and more FUD.

    • by Kjella (173770) on Saturday April 26, 2014 @05:45AM (#46847141) Homepage

      I fail to see the problem with his choice of words, you find exploits and put them in an arsenal of attacks. Just because you count number of exploits and not numbers of guns it's still an accumulation of weapons set aside for future use in cyber-warfare. And of course it costs lots of money to maintain such an arsenal as old exploits are patched or the vulnerable software or hardware goes out of use, it doesn't have a shelf life like physical weapons but your capability degrades over time unless you supply it with new exploits not entirely unlike when your enemies upgrade their weapons capabilities making yours obsolete. At least it's no worse of an abuse than using "cyber warfare" for sending bits and bytes instead of bullets at each other.

    • by gnupun (752725)
      What would happen to the exploits if these apps and services were reimplemented using safer languages like Java and .Net (i.e. replace C/C++) that don't allow buffer overflow/underflow? Sure, the hacker would still be able to crash the program, but it's highly unlikely he can gain control of the system or do any kind of crazy damage to important data.
      • by Entropius (188861)

        Then those apps and services would run really, really slowly.

        (Yes, I know Java can be made to not suck, but every .NET program I've had to deal with has been clunky.)

      • Buffer overflows are one important class of vulnerability. They are also fairly easy to prevent /detect in new code. Use strncpy, not strcpy, etc. Static analysis can flag the dangerous constructs 99.9% of the time.

        Java and C# are vulnerable to other, less readily identified vulnerabilities because key parts of the operations are hidden in the libraries and programmers are not accustomed to thinking about them. Both can easily have vulnerablities from memory management problems, but they can be harder to

  • by timeOday (582209) on Saturday April 26, 2014 @01:04AM (#46846675)
    If cyber "war" has replaced nuclear war then that is an excellent trade. Even John Kerry was waxing nostalgic for the Cold War [yahoo.com] the other day. What a joke! Are people that dumb? Have we so quickly forgotten what it was like to face a REAL threat of annihilation and actual global destruction? I would take another 9/11 over another Cuban Missile Crisis any day of the week. Let alone some computer hacking.
    • Re: (Score:3, Insightful)

      by tragedy (27079)

      Technically speaking, most of those nuclear weapons everyone was afraid of back then are still there, just waiting to be fired. Now, rather than the Soviet Union, they're in the hands of Russia. A least nothing is going on that might increase tensions between Russia and the rest of the world right? Oh, and fortunately Russia isn't run by some hard-right authoritarian, obsessesed with projecting strength.

      • by Kjella (173770) on Saturday April 26, 2014 @06:31AM (#46847205) Homepage

        Technically speaking, most of those nuclear weapons everyone was afraid of back then are still there, just waiting to be fired. Now, rather than the Soviet Union, they're in the hands of Russia. A least nothing is going on that might increase tensions between Russia and the rest of the world right? Oh, and fortunately Russia isn't run by some hard-right authoritarian, obsessesed with projecting strength.

        The Soviet Union with half of Europe as allies was a superpower. Russia is barely in the top 10 biggest economies of the world, they have 140 million men against 900 million in NATO. Their military technology and spending suffered during the reforms, by all means they're powerful but they got no chance of pulling off a victory. Putin is gambling that nobody wants to pick a fight with Russia over a few areas in Ukraine, if he's called on it they'd lose but probably not before a hundred million people have died. Unless of course China were to join on the Russian side, 1.35 billion people and the world's second biggest economy along with Russia's nukes would give NATO a real run for their money. Personally I think what's happening in Ukraine will push all the other countries in the "buffer zone" between NATO and Russia to seek NATO membership over Russia's objections.

        • by tragedy (27079)

          Russia still has the nuclear weapons that had everyone scared of nuclear annihilation back in the day. Well, technically the US has most of the nuclear weapons that had everyone scared of nuclear annihilation back in the day, but Russia still has its share.

        • The thing about MAD, it isn't about winning. It's about "neither side can win." And Russia still has the power to ensure that no one who engages in war with them can win.
    • by kamapuaa (555446)

      John Kerry said diplomacy was simpler then than it is today - considering his experience as a soldier and a prominent protestor in the Cold War, and now as a top diplomat, he might know what he's talking about.

      • by MerlynEmrys67 (583469) on Saturday April 26, 2014 @02:45AM (#46846875)
        He may know what he is talking about, or maybe he just doesn't understand how good Kissinger was at his job. A master of a profession makes it look so easy that even someone with mediocre grades at Yale (He was outscored by W. after all - and see what people think of him) can do it. Turns out there are a lot of subtleties that I don't think our current batch of diplomats understand.
      • by timeOday (582209)
        That's why I said "even" John Kerry, I was surprised he said it. Vietnam was a flareup of the Cold War and killed about 60,000 of us and about 1,500,000 million of them. In absolute terms, what is going on now that compares?
  • good (Score:4, Funny)

    by stenvar (2789879) on Saturday April 26, 2014 @01:06AM (#46846679)

    Instead of global thermonuclear war, we now have to worry about WoW going down. Seems like a good tradeoff to me.

    • Re:good (Score:5, Insightful)

      by Calibax (151875) * on Saturday April 26, 2014 @06:09AM (#46847171)

      Instead of global thermonuclear war, we now have to worry about WoW going down. Seems like a good tradeoff to me.

      Instead of WoW, worry about the national infrastructure. Imagine all the SCADA devices insecurely connected to the Internet going down more-or-less simultaneously. No electricity, natural gas, or water distribution systems, no sewage treatment, etc. After a few hours/days without electricity the backup systems would start dying, so no phones or Internet either.

      So no WoW, as you pointed out. But that would be the least of our problems :)

      • by stenvar (2789879)

        The SCADA systems are hundreds of thousands of different platforms/version combinations. Many of them aren't even connected to the Internet, many are based on firmware. Most are easy to secure and restore if they get corrupted/attacked.

        "Cyberwarfare" really is a misnomer. In regular warfare, bombs and guns don't have compatibility problems, you permanently destroy infrastructure or occupy it, and you kill people trying to restore it; in "cyberwarfare", the attacks only work against compatible hardware/softw

      • by Agripa (139780)

        Instead of WoW, worry about the national infrastructure. Imagine all the SCADA devices insecurely connected to the Internet going down more-or-less simultaneously. No electricity, natural gas, or water distribution systems, no sewage treatment, etc. After a few hours/days without electricity the backup systems would start dying, so no phones or Internet either.

        An easier target would be the banking and government systems. Just screwing up social security transfers would be effective if slower.

    • Imagine a 9/11 style attack, or a "poison gas in the subway", but at the same time they take out both the cell phone network and the most important radio trunking system used by first responders. The next day, the bad guys trigger the New York blackout.

      Or, think back to how the US won the cold war - slowly, gradually, by economically outperforming the Soviets. The US is already the target of sustained, large scale attacks. If those attacks improve to the point that it costs 1%-3% of GDP in defense or dama

  • by aralin (107264) on Saturday April 26, 2014 @01:46AM (#46846773)

    ... and let me tell you, if Cyber War replaces Cold War, they are winning this time...

  • Is the army protecting us from this?

    I.e. in the advent of a cyberwar will our army do anything to protect private infrastructure like the electricity supply or the banking system from harm?

    Right now: No.

    The book to read on this is "Cyber War: The Next Threat to National Security and What to Do About It" by Richard A. Clarke. A great read and very scary.

  • ... mission-critical things like banking and providing essential government services should "play it conservatively" and not be at the forefront of technology.

    OR, where it makes sense for them to be at the forefront, the "old way of doing things" should be kept around until after the "new" way has proven it is robust enough for the task.

    Being "robust enough for the task" means, among other things, not having unacceptable levels of downtime under normal or abnormal-but-common conditions (such as DDOS attacks

  • Code war: What the US and the Soviet Union had during the nasopharyngitis [wikipedia.org] outbreaks of the 1950s through the 1980s.

  • Of course instead of laying off everyone in sight in favor of making everything "web-based" and "self-service" major corps and governments might try using people to deal with people but of course that cuts into bonuses and dividends...

The use of anthropomorphic terminology when dealing with computing systems is a symptom of professional immaturity. -- Edsger Dijkstra

Working...