Russian Kill Switch

A better write up of the coming Russian Kill switch test. 

https://www.engadget.com/amp/2019/02/28/russia-putin-internet-kill-switch-cybersecurity/?__twitter_impression=true

My impression is that it's more about Russian domestic politics than anything else, though it doesn't hurt to consider what else could happen. Not even necessarily with Russia. In the back of my head I've been mulling over what the possibilities are in cyberspace. Most of what we've been seeing is more like criminal behavior, even if it's done by nation/state actors.

But I haven't really fleshed anything out on that yet. Still learning so much in the first place, you know?

Edited to add: I decided to add labels here (I tend to forget when sending out a quick link from my phone) and figured this article was worth including in the post. It's discussing how Moody is trying to incorporate cybersecurity into it's evaluation on how creditworthy an organization is.

Cyber-Security Analogy, Cont.

If you want to change the threat environment, you can also consider ways of reducing the number of attackers. Right now it's really, really, really difficult to hold attackers accountable. It's not just that they can fake their id's, it's also that they may come from or pass through other nations on their way to attack your castle. And we don't necessarily have any sort of agreements with those nations that would allow us to enforce our laws on them.

While I do think we need better international cooperation to hold attackers accountable, there's another issue at work here. How do you identify someone as an attacker in the first place? How do you trace back their identifier to the original person?

Tackling that problem is something I have reservations about, in that it's great to focus on that if you want to catch bad guys, but it also is something that can be used to oppress or suppress good people. Consider what I'd said about wanting to explore the Dark Net, and wanting VPN and whatnot before doing so. My reasoning for all of that?

I want to understand the world on a holistic level... and the darker side is part of that. Can we truly understand economics, for example, without understanding the role shadow economics plays in it? I don't know... I don't think there's any equivalent to GDP for the underground economy. There might be a few studies that explore how money gets laundered and how much of it comes back into the legitimate economy, I dunno. Maybe the underground economy isn't large enough to really impact anything, maybe our economists can make sound decisions without ever considering that side of things... But how would we know if we never even consider the possibility?

It's a bit like how some biologists really love looking into how an ecology handles decay. Would there be horrible ecological consequences if we got rid of nasty critters like mosquitoes and flies? You don't know unless you look into it. (I think I read that we could get rid of mosquitoes with little to no consequences, which would be awesome if true and doable.)

The Dark Net seems like a good place to get a better understanding of the shadows in our world, but I have some serious trepidations about going there. It's like turning over a rock, or spelunking in a cave. I'm not sure what I'll find, I'm not sure what I would do with what I'd find, that sort of thing. But... I do know that before I go spelunking in such dark caverns I'd want to do my darndest to make sure nobody there could ever trace me back to my physical address. So I want a VPN service, might try to use Tor, that sort of thing. (I haven't tried too much to maintain privacy online so far, tbh. I know a lot of computer people who flat out refuse to use Facebook any more, but I still have a lot of friends and family there and haven't completely opted out yet.)

Bringing this back to cybersecurity - any attempt to make it easier to identify people online will also make it easier for abuse to happen. Like authoritarian governments tracking down dissidents, or online mobs doxxing people they don't like.

I have reservations about making it easier to identify people online, but I also know that attribution is especially important if we're dealing with a nation/state threat level and want to deter attacks.

How could Ukraine hold Russia accountable for the 2017 Petya attacks, and prevent any future such attacks from occurring, when Russia denies involvement and calls the accusations "unfounded blanket accusations".

Musings

I suppose I ought to explain a little bit more about my previous post.

I sometimes think about Whitney's Houston song, One Moment in Time. It captures something I want, a driving force if you will... the urge to have that one moment in time, one moment "where I'm all that I thought I could be."

I suppose it's pretty much the top tier of Maslow's hierarchy of needs. Self-Actualization.

Computers...

Well. Putting this into words is harder than I thought.

When I learn something, I tend to get a feeling for the connections between things, holistically I guess. I don't really like rote memorization, but if I can sense the connections between things I'm pretty good at remembering how it all fits together. I sometimes use terms like 'see' or 'visualize', but it's more visceral than that. Sort of like building a mental map, or following a flow chart I guess.

When I learn something new, it's a bit like building a puzzle. I get a piece, I find it connects to another piece, and the more I immerse myself in the topic the more pieces I get, the more connections are formed, the more the pieces fall into place and the more complete the picture gets. I sometimes get formal training (MDMP, IPB, etc) and sometimes it's stuff I pick up on the job... mostly by jotting down anything unfamiliar and asking about it. Do that often enough, and soon you too can throw out an alphabet of acronyms - ECS, AMG, IPB, EJK, VBIED, etc.

All that is sort of like learning the basic rules of a game (like canasta). Training in the basics and whatnot. It starts off unfamiliar, but the more I immerse myself the more it all starts coming together.

I've always had an interest in national security issues, and cyber security is sort of uncharted territory there. A new dimension that we're just beginning to make sense of. We've got doctrines regarding land warfare, naval warfare, aerial warfare. We kind of know how they work, even though things change as technology changes (i.e. how fast you can maneuver, what sorts of countermeasures work against what, etc.)

But cyber security? We're all still figuring out what's even possible, much less how to counter it.

Right now... well, right now I'm at the very beginning of learning the field. Okay, sure. I've got a master's degree in computer science now. It reminds me of what they say about black belt training - i.e. the black belt just means you're ready to begin learning. It's nice to read articles and realize I can actually follow most of it. I can throw out terms like TCP, UDP, IP, IDS, SSH, FTP etc. and have a fairly good idea of what they mean.

But it's just the beginning. Give me five to ten years of experience and further training (if I can get my future place of employment to pay for some SANS courses that'd be hella awesome), and maybe I can talk knowledgeably about cyber warfare.

So no real regrets about the things I mentioned in my previous post. I know some of that is typical human behavior (i.e. we have a tendency to make stories about our lives and to a certain degree it's easy to be at peace with things when I feel life is going well. I had a phone interview that went well, have an in-person interview scheduled for January, and if things work out then life is good and I have no real complaints.)

And who knows, maybe in five-ten years I'll have a sense of where cyber warfare fits in with the rest of it.

Cyber Warfare

Cyberwarfare.  Everyone know that's the next big thing, but nobody seems to know how it will really play out.  (This is part of why I'd like to take some classes in computer science - to learn more about what's possible)

We know a bit about what we've seen so far.  Stuxnet.  The 2007 attack on Estonia.  Titan Rain.  Criminals that use cyber attacks to get money - through ransomware, DDOS attacks, and more. I also know a little, very little about what's possible.  Like the ability to hack someone's vehicle.

Cyberattacks are odd, in that it's hard to say if an attack is state-sponsored or based on individual criminal behavior.  Attributing an attack to state is...difficult.  Which also makes it hard to determine how a state should respond.  Would a cyberattack be grounds for war?  Would it lead to a more conventional response?  At this point, there's a lot of uncertainty about it.

I want to point out a couple of things.  DDOS attacks, to me at least, are more of a minor annoyance than a real threat.  I wasn't aware of the recent attack until after the fact, for example, because I was at work and wasn't trying to access any of the sites affected.  For me, as long as I can wait anywhere from a couple of hours or more, it's not a big deal.  Yet criminals are apparently able to make money off of these, because businesses lose money the entire time the system is down. (These issues, btw, raise questions about whether we want political leaders who have a poor understanding of computer issues.  It does not seem uncommon for older and more established politicians, for example, to be uncomfortable with smart phones and other aspects of the internet.)

While I heartily recommend talking to someone with real expertise on these issues, I do want to make a few points.

First, given what I said about how little Friday's DDOS attack affected me personally, some attacks are not really effective if you're able to unplug.  This is worth pointing out, as there still are a number of people who haven't moved into the internet world completely.  Granted, most of them are a bit older...but in my current job I am repeatedly astounded at how many of my employees are not comfortable with or familiar with what I used to consider basic computing skills.  I've had to assist them with figuring out how to get information over the internet - whether using a website to get a company award, or information on their retirement plans, and more. 

I do wonder whether cyberattacks would be more problematic in another twenty or thirty years, as people who know how to do things the old way are no longer around.  (For example - when I was in the military we all learned how to read maps.  Nowadays, many people use the GPS on their phones to navigate.  If an attack took down GPS, how many people could navigate using a map?)  Or take the example I used earlier where someone hacked a car.  Older cars might be safer, since they don't have all the computer chips and whatnot inside. 

It also means that EPM attacks are a very, very serious concern...since it would shut down a LOT of things we've become dependent on.

The importance of the internet is also worth pointing out, though again we still have old technology (like radios) that we can fall back on if need be.

I'm posting this more to point out the very large question mark we all should have with regards to cyberattacks, then to provide any real answers.  I think/hope that most countries are taking steps to secure any critical infrastructure, and have fallback plans in place in case computer chips and technology fail.  I believe the Department of Defense has taken steps to create a Cyber Command, and this could well become another branch (Air, Land, Sea...and now Cyber?)

Sony Hack, North Korea

In more modern news, I finally started tuning in to the Sony hack.  When I first heard about it, it seemed like more of the same old, same old.  Some company gets hacked, private data is revealed, security is horrible, *yawn*.

Then I heard people mutter 'act of cyberwar', and 'North Korea'.  And there's been a lot of disgruntlement that a silly little dictator of a mostly irrelevant country could somehow stifle artistic freedom.

I never even heard of this movie until the hack, but now if I knew of a place that was showing it I would definitely go.  Just to stick it to whoever thought it was a good idea to go to such lengths over a silly little movie.

A LOT of people I know feel the same way.  It's freedom of speech and artistic license, and you shouldn't mess with it.

I posted this on facebook, but this is what I would like to see happen.  I would love it if someone 'leaked' the entire movie online.  I know a certain clip has already leaked, but the whole movie should be put out there as well.  I'm sure more people would watch it online than would ever have watched it if it had been released like normal.

Second, if movie theaters are unwilling to play it due to fear of litigation (which seems kind of cowardly, except I know some idiot would sue if they were injured while at a theater because of this...so I'm not sure I can blame them.  That's a discussion for another time.)

Right.  So if movie theaters are unwilling to play The Interview for security reasons, I think every military base should offer to play it at the theaters they have on base.  Just make sure everyone goes through the security at the gate, and be prepared for long lines and whatnot.

And if someone tries attacking a military facility over the movie, you will quite clearly have your act of war.