<nettime> Cyberwarfare

[<alert@stratfor.com>]

Stratfor.com's Global Intelligence Update - 15 May 2000
__________________________________________
Know your world.
http://www.stratfor.com
_________________________________________
This weekend on Stratfor.com:

Belgrade-Baghdad Military Ties May Be Paying Off in Air Defense

A commander in Iraq's air defense forces announced that Iraq has
been neutralizing U.S. HARM anti-radar missiles. If true, Iraq's
cooperation with Yugoslavia on air defense appears to be yielding
concrete results.
http://www.stratfor.com/MEAF/commentary/0005122315.htm
__________________________________________

"I Love You" and the Problem of Cyberwarfare

Summary

Last week, officials from the government and the computer industry
gathered in the wake of the massive denial of service attacks
against commercial web sites and the outbreak of the "I Love You"
virus. The real problem the United States and much of the world
faces is that people are overwhelmingly dependent upon a single
computer operating system that is exceedingly vulnerable to even
simple attacks. The PC and the Internet have become indispensable -
while remaining indefensible.

Analysis

Last week, U.S. government and computer industry officials gathered
in California for a summit on computer security. The meeting took
place in the wake of a recent spate of computer viruses and
attacks, including the massive denial of a service attack,
apparently launched by a Canadian teenager, and the "I Love You"
virus, seemingly launched by someone in the Philippines.

It is important to realize that neither of these attacks were
developed by computer geniuses. The Canadian teenager's ability to
shut down Amazon.com was perhaps one notch more sophisticated than
setting an autodialier on a telephone to repeatedly call someone's
phone, making it impossible for real callers to get through. The "I
Love You" virus was a simple macro written in a fairly simple
language, Visual Basic, that took advantage of the lack of security
on Microsoft's e-mail package. No one is going to be offering
either of these software creators jobs at the National Security
Agency.

Some people are taking comfort in this. John Dvorak, a usually
astute observer of the computing world, wrote in PC Week, "The Love
Bug Virus is the type of thing that's great for keeping journalists
busy on a slow news day. I've never seen anything get so much ink.
The question of the day: Will writing two-bit destructive viruses
become the way that loners and goofballs get their 15 minutes of
fame? I suspect this is the case. It certainly beats setting
oneself up on the school clock tower and picking off fellow
classmates with a rifle."
___________________________________________________________________
Would you like to see full text and accompanying
articles?
http://www.stratfor.com/SERVICES/GIU/daily.asp
___________________________________________________________________

Dvorak is of course right - but he's missing his own point. Vitally
important news is being made. The news is this: It is now possible
for a comparatively unsophisticated computer programmer to create
absolute havoc. It is not the hacker's psychological profile that
is interesting; it is the intellectual profile that is stunning. It
used to be possible for a brilliant but unstable person to wreak
havoc. Today, a not particularly bright crackpot can achieve the
same outcome. And that is the point. There are few brilliant people
in the world. There are lots of dullards. Based on the ratio of
fools to geniuses, the likelihood of future attacks increases.

The problem is this: the personal computer and the Internet are
both revolutionary - and yet, terrifically vulnerable. Both are
less than a generation old and comparatively primitive, like the
telephone or automobile early on in their evolution. Yet the
revolutionary nature of computing today allows all kinds of people
to do important things in ways once impossible. Everyday people in
all walks of life and work have become dependent on these systems.

The vulnerability of these systems stems from the simple fact that
they were never intended to be the center of such dependency. The
personal computer was developed as a stand-alone system. Unlike
mainframes with multiple users using multiple accounts, the PC was
deliberately designed to serve the needs of an individual. The
entire purpose of the PC was to be a functioning system that
provided the user unfettered access to his data, programs and even
operating system. Hence its name. It followed from this that the
individual was unlikely to seek to harm his own computer or the
data on it. Security was hardly a priority.

Connectivity between PCs has crept in slowly. Not so long ago,
people couldn't conceive of a mass market for PCs. As word
processors and spreadsheets emerged, the usefulness of the PC
became more apparent. Still, few people in the 1980s imagined that
one of the PC's primary roles would be that of a communications
device. At first limited to a handful of military and academic
users, e-mail usage began to explode in the late 1980s.

Early e-mail had been built around a few academic mainframes. A PC
user would get a campus account - either on a mainframe or
minicomputer - in terminal mode, not as a true computer. He would
dial up to that account via a modem, at 300 or 1200 baud. That
computer would link to other computers in a crazy quilt pattern
called Bitnet, which had spun off from ARPAnet (a Defense
Department initiative). Over time, data files were stored on
various university mainframes. One of the biggest was at the
University of Minnesota, with tons of non-graphical information.
Using this network of computers, the user could hop around the
world. Out of this primitive connectivity, came the explosion of
the World Wide Web.

But the PC was never intended for this purpose - it was created for
a single user. Efficient usage meant that much of the function of
the operating system was hidden from the user, who really didn't
need to know what was going on within the system. Also, in the
interest of ease of use, the different applications became more
tightly integrated with each other and within the file system. The
outcome, of course, was the Microsoft-driven computer of today
where the word processor, spread sheet, e-mail package, web browser
and file system are intimately connected.

As a result, it is difficult today to figure out exactly what is
going on inside your own computer. The integration of processes
obfuscates the operating system. A good example can be found in the
famous "blue screen of death" that functions like a "service
engine" light. It tells you that you are in trouble, but doesn't
tell you why. The inability of the Microsoft Operating System (OS)
to tell the user what is wrong is a feature, not a bug, as they
say. The OS frequently doesn't have any idea what has failed. The
complexity of the system itself makes transparency impossible.

Microsoft triumphed because it provided for the easy exchange of
files within the PC and between PCs. But that very ease of exchange
created the current potential crisis. The Microsoft operating
system took advantage of connectivity opportunities. Once the
computer became connected, it was no longer under the sole control
of the owner, whose interest was in protecting his computer and his
data; instead the owner is now exchanging information with others
who might have more malicious interests. The structure of the
Microsoft OS made it extremely difficult to deal with maliciousness
for two reasons:

1. The increasingly tight integration of the OS with applications
and links between applications means that malicious imported code
can migrate rapidly from one part of the system to another. The "I
Love You" virus, for example, attacked the address book of the
email system, as well as attacking music and graphics files.

2. The lack of transparency of the operating system makes it
extremely difficult to create programs that can see what is
happening inside of the computer in real time, creating shut-offs
or fail-safes. Current anti-virus software is forced to identify
known viruses by scanning incoming files. This means that new,
unknown viruses can't be stopped.

During the denial of service attacks on web sites, no one could
figure out where attacks came from because a single attacker can
route attacks through thousands of computers. It is possible to
plant malicious code on a computer whose mission is not to attack
the host computer - but to propagate itself to other computers and
then to begin simply linking to Internet sites, shutting them down
by sheer overload. Finding these tiny bits of malicious code on a
server is mind-numbingly difficult. It can be anywhere in the file
system and called virtually anything. There is some software
designed to detect this code. But it needs to be installed by
people who are concerned with damage to other servers - altruism
that is fairly rare.

A teenage kid can knock out hundreds of corporate systems because
the foundation of modern computing, the operating system, has been
in rapid, forced development since the success of MS-DOS. It was
designed for one user who would treat it right. The hyper-
connectivity of the Internet exposes it to code delivered by
others. The Windows operating system was simply not built with this
in mind. It has served brilliantly as a tool for exchanging
information.

But its very success has created the menace. The neat macros
created in a spreadsheet can be made malicious by a teenage kid.
Interoperability and interconnectivity were created without regard
to security. And there can be none without transparency. You can't
be secure if there is no method for knowing what is happening in
your operating system. It is the perfect environment in which
viruses can flourish. That is true on the client and the server.

The problem is that we are dependent on these systems for our daily
work and our daily work can be used to spread harmful programs. If
a teenager can wreak this havoc, imagine what a concerted effort by
a well-funded government intelligence agency can do. That, of
course, is the point. Dependency on the computer and the Internet
at this primitive stage of development opens us to attack,
particularly from societies that are not dependent on PCs and the
internet, but that do possess the intellectual skills needed to
mount the attack.

One executive of an anti-virus company has suggested that you
should never open a file from someone you don't know. That is a
measure of how shallow our defenses are. How can you be sure that
the person you know hasn't become infected? In fact, how can you be
sure that the person you know doesn't want to zap you? Some
companies have solved the problem by prohibiting attachments and
removing floppy drives. In other words, they have solved the
problem by losing the capability. The solution is not in policies,
but in technology. The problem's center of gravity is the operating
system.

Security requires a complete re-engineering of the operating system
to permit rapid diagnosis through complete transparency. It will
not be easy to evolve Windows or NT in this direction. It seems
that officials may want to deal with this problem. After all, the
real threat from rogue states won't be nuclear attack, but cyber
attack. Rogue states won't launch nuclear attack for fear of the
counterattack. But how do we retaliate against a virus attack? We
depend on computers. They don't.

_______________________________________________
For more Weekly Analyses:
http://www.stratfor.com/SERVICES/GIU/archives.ASP
_____________________________________
(c) 2000 WNI, Inc.
__________________________________________________
SUBSCRIBE to the free, daily Global Intelligence Update. Click on
http://www.stratfor.com/services/giu/subscribe.asp
UNSUBSCRIBE by clicking on
http://www.stratfor.com/services/giu/subscribe.asp
___________________________________________________
Stratfor.com
504 Lavaca, Suite 1100 Austin, TX 78701
Phone: 512-583-5000 Fax: 512-583-5025
Internet: http://www.stratfor.com/
Email: info@stratfor.com

#  distributed via <nettime>: no commercial use without permission
#  <nettime> is a moderated mailing list for net criticism,
#  collaborative text filtering and cultural politics of the nets
#  more info: majordomo@bbs.thing.net and "info nettime-l" in the msg body
#  archive: http://www.nettime.org contact: nettime@bbs.thing.net