The term “cyber warfare” may suggest virtual worlds like those depicted in movies like Tron, or the “fire sale” in Live Free or Die Hard. But while these fantasy renditions are far from reality, actual cyber warfare is no less fantastic. Indeed, it is a very real concern…and one very important to those in the Armed Forces. One only needs to look at the plethora of viruses and worms in the wild, and the extent of antivirus industry, to understand the extent of the ongoing cyber war. Connectivity and the Internet has changed the scope of the discussion.
In the military there is a well-known saying: “Tactics wins battles, but logistics wins wars.” This is just as true for cyber warfare, where computer security is paramount, as in a physical battle. These days the virtual and real worlds overlap, because every major system employed by the military (short of a knife) incorporates or is related to a computer—from night-vision scopes to fly-by-wire aircraft. In the past, many systems were physically isolated, allowing physical defenses to be employed for protection of a system. But the push for connectivity in the modern military is extreme. It allows pilots of unmanned aerial vehicles (UAVs) to be located on the far side of the planet from their aircraft (see figure).
It is important that the low-level tactics of cyber warfare—like multiple independent levels of security (MILS) and computer viruses—do not overwhelm the strategic aspects. The challenge is that cyber warfare needs to address not only defense, but offense as well. To quote Sun Tzu in The Art of War: “In battle, there are not more than two methods of attack—the direct and the indirect; yet these two in combination give rise to an endless series of maneuvers.” That tends to be almost an understatement when it comes to computer-based attack and defense. Combine this with the fact that the computers involved may directly or indirectly control weapons, men, and material, and the effect it can have on a fighting force can be significant.
The challenge for a country like the United States is the breadth of technology involved. The US Department of Homeland Security (DHS) has an Office of Cybersecurity and Communications, but this targets only one aspect of the discussion, and it favors preventive measures. More covert civilian work is commissioned by US government groups like the Central Intelligence Agency (CIA) and the National Security Agency (NSA).
The US Strategic Command (STRATCOM) and its Cyber Command oversees cyber security for the US Army, Navy, Air Force, and Marines. This includes the US Navy’s Fleet Cyber Command, the 24th Air Force, the US 2nd Army’s Cyber Command, and the Marine Corps’ Cyber Command. These groups are tasked with network defense, as well as attack and exploitation of enemy systems. They even participate in joint training exercises—among them Cyber Flag, conducted at the Air Force’s Red Flag Facility at Nellis Air Force Base, Nevada. The competition was virtual, but the prospect of a group penetrating the opposition’s network—gaining access to a wide range of command and control—is all too real.
The tools of the trade are well known but not heavily publicized, unlike some high profile military ventures. This is true for military intelligence in general, which means most—even in the electronics industry—will be unaware of the detailed tactics or strategy being employed. The work also tends to be more far reaching, from tracking of personal data and social networks to control of digital litter and digital devices. Much of this can be done remotely and in front of a computer screen, but the importance of field work should not be discounted. Device designers need to be aware of both the technology and techniques.
Computer attacks on soft targets, like bank websites, are highly publicized and affect thousands (or even millions) of customers. That same kind of publicity occasionally occurs in other areas, although often the culprit remains anonymous. The Stuxnet computer worm is a good example: This malware spreads through computers running the Microsoft Windows operating system (OS) and targets Siemens supervisory control and data acquisition (SCADA) systems. It includes a programmable-logic-controller (PLC) root kit, designed to hide the attack. Stuxnet’s potential target was Iran’s nuclear research facilities, which utilized SCADA.
Unlike a typical computer virus or worm, Stuxnet uses a multilevel approach. It first attacks a Windows system, typically via a Universal-Serial-Bus (USB) key or, alternately, through a network using a number of zero-day exploits, including those based on device drivers signed using stolen digital key certificates. Root kit technology hides Stuxnet on the Windows machine, but the eventual target is a Windows system with SCADA control software.
The Stuxnet payload is very specific because it is looking for a variable frequency drive control operating between 807 and 1210 Hz. That is just what one needs for a gas centrifuge. Siemens released a detection and removal tool, but that is just part of the story. Flame, a new worm, has been found in 2012. Flame and Stuxnet highlight why the defense-in-depth approach is needed. Intrusion detection systems (IPS) and antivirus software are important parts of this, but a multilayer system needs to address this issue at all layers.
On the plus side for defenders, the common toolset is becoming more security friendly. UEFI and secure boot are being utilized on consumer platforms, making them more readily available to designers. They are found in commercial-off-the-shelf (COTS) systems, negating the need for custom hardware. Likewise, encrypted hard drives and other hardware are making the designer’s job significantly easier. They are not the be-all, end-all solution but, rather, one part of a much larger approach that can be eventually managed with a high-level strategy.
Embedded developers need to maintain awareness, and utilize newer technologies (e.g., IPv6 and DNSCrypt) that are more resistant to attacks. IPv6 is more robust than the more common IPv4 in security as well as other aspects of its design. The open source DNSCrypt provided by OpenDNS works to protect the domain name service that is critical to the Internet, as well as most networked embedded devices. This means that protocol stacks must support these types of technologies, and developers need to utilize them in more than just their default configurations. As any security expert will warn, all the links in the defense change need to exist and work properly, or else most (if not all) of the system can fall apart.
Expect to see more government work in this area, as well as the rise of “digital privateering.” These privateers are crackers for hire by governments and other organizations. Attacks or creation of attack technology is just one of the possible services these groups might offer. One reason for this is cyber attacks are more of an art because of how quickly technology changes and how arcane the gaps in a defense may be. Much of this expertise is limited to a few individuals.
Currently, cyber warfare exists in the form of a cold war, but goverments and military organizations are expected to become much more active in 2013 moving forward in building up their cyber arsenals. The US government is fully aware of the potential harm that could come from a cyber attack on a critical target, such as a nuclear power plant or a water-treatment facility. Unfortunately, the US Congress tends to move slowly concerning the defense of what it perceives as more of an imaginary threat than a real one. Cyber warfare may be a computergenerated threat, but it has the capability to cost lives if proper defenses are not installed, especially if an attack takes place against such a critical target as a nuclear power plant.
Cyber warfare may seem like an esoteric issue for many designers working in defense electronics but, like security in general, it is an aspect of designing electronic systems that must be incorporated from the start in order to be efective. Strategy can only take advantage of tactics that are possible. The low profile of cyber warfare may make it difficult as sequestration takes hold and groups work to minimize the effect of defense spending cuts.