In a recent article appearing in Bloomberg Technology, Chris Strohm writes that the incursions by Russian hackers also used social media to influence the election outcome. He writes, “Material stolen by Russia’s intelligence services was feverishly promoted by online personas and numerous fake accounts through links to leaked material and misleading narratives.”
The evidence of this comes from FireEye, a company that tracks Russian and Chinese hackers making attempts to break into U.S. computer systems. Strohm quotes David DeWalt, Chairman of FireEye who states, “The dawning of Russia as a cyber power is at a whole other level than it ever was before…..We’ve seen what I believe is the most historical event maybe in American democracy history in terms of the Russian campaign.” The Russians not only hacked the Democratic Party’s email servers and then gave the contents to whistle blowers to put on the web, but also created fake news largely denigrating to Hillary Clinton, which was then spread through the Facebook and Twitter universe using artificial intelligence bots to do postings. FireEye mapped the Russian campaign identifying six key false “hactivist” personas including Guccifer 2.0, DC Leaks, Anonymous Poland and Fancy Bears’ Hack Team. Bots automatically spread the misinformation through fake social media accounts to generate a significant volume of lies and deception. More legitimate whistle blowers like Gawker and Smoking Gun were sent material which they then spread not knowing its legitimacy or illegitimacy. Even legitimate journalists were offered stolen and false information from false email accounts. And FireEye states that the activity post-election continues.
Chairman of the House Homeland Security Committee, Michael McCaul, Republican, from Texas referred to the hacking as a “wake-up call.” John McCain, Republican Senator from Arizona has also called for hearings on Russian cyber activity.
Worldwide the problem is just as severe. Back in September the German government and industry described 20 daily hacks of sensitive networks. Volkswagen reported 6,000 attacks per day and one in five German companies noted attempted or successful hacks of internal networks. Yesterday, Germany’s head of federal security, Hans-Georg Maassen, warned of Russian tampering with the upcoming 2017 election with the goal to “weaken or destabilize the Federal Republic of Germany.” As in the United States the Germans claim that Russia is financing misinformation campaigns using state actors to launch cyberattacks. To underscore the level of exposure, this week German steelmaker, ThyssenKrupp, reported a massive cyber attack that started in February and ran through April. Project data from the company’s engineering division was stolen.
A report on the extent of the Russian hacks will be useful to help the U.S. government, others nations and businesses to better understand how to shore up defences. But what other actions can be taken? Is this the first round in what will become a cyberwar between nations and businesses?
In a recent IBM study it was found that 66% of organizations fail to recover from cyberattacks. Those companies participating in the study reported:
IBM reported that 2016 was one of the worst for cyberattacks with denial of service causing major web outages such as the October 21, 2016 attack that disrupted Paypal, Spotify, and Twitter. The attackers targeted Dyn, an Internet hub by using Internet-connected devices with embedded malicious code. The outage began in the Eastern United States and then spread to the rest of the country, Canada and Europe. The attack took down CNN, the New York Times, the Wall Street Journal and some Amazon-hosted business sites. Bruce Schneier, a security guru, believes that a country is behind the October 21st attack and that it was a test of the resilience of the system to overcome the security breach.
Russia, not wanting to be left out of being a potential cyber victim, stated in the last week that it too was being targeted by “foreign spy agencies” out to create chaos in its banking system. The attack was supposed to begin on December 5th originating from servers in the Netherlands. The Russians, however, claim that they parried the threat and that the “situation is under control.” At the time of the alleged attack Vice President of the United States, Joe Biden, had indicated to Russia that any cyberattack by them would be met with a proportional American response.
The United States currently has a lack of qualified information security people on board to fight back despite Vice President Biden’s “proportional response” remark. The industry is short about 200,000 to meet the current job listings. The U.S. federal government has called for 3,500 new hires by the end of 2016. Worldwide the shortage amounts to 1 million.
An answer to this decided lack of human security expertise is to bring artificial intelligence into the mix. This involves, states Amir Husain, CEO of SparkCognition, an artificial intelligence start up, “a diminished role for humans.” It’s not such a stretch when you consider every PC includes a firewall and antivirus software, pattern recogniton algorithms that help protect our home and office computer systems. Husain is just talking about upping the level of surveillance through more sophisticated software capable of responding to cyberattacks. DARPA, the Defense Advanced Research Projects Agency of the U.S. Department of Defense, recently organized a hacking competition which Mike Walker, DARPA program manager, describes as a way “to build autonomous systems that can arrive at their own insights, do their own analysis, make their own risk equity decisions of when to patch and how to manage that process.” IBM has also turned Watson, its cognitive technology, to the task of detecting cyberattacks and computer crimes by having it absorb everything in print on the subject.
States Husain, “Insofar as machines can sense and monitor the world in ways that go beyond our biological abilities, they will have greater insight – higher quality insight with more depth.”
Last Friday as I was writing a blog I suddenly realized just how dependent I had become on networked knowledge and the level of frustration and alarm that I felt when suddenly the sources of that information were being denied to me. At first I thought the reason I couldn’t connect was related to a browser error. So I saved my work, shut my browser down, tried a different one and started working again. But as I tried to connect with familiar sites the same messages came up telling me they were inaccessible.
That’s when I went to Google news sources and found out that I was witnessing a massive attack underway on a key piece of the Internet providing services to hundreds of websites. One of those sites was Twitter, another PayPal, another Amazon.
The type of attack is called a Distributed Denial of Service or DDoS. It consists of the simultaneous issue of millions of visit requests to targeted websites causing the hosting servers to become overwhelmed by the traffic and crash. Normally a DDoS attack originates from a user with malicious intent to break a company or service online. The user harnesses hundreds or even thousands of computers by infecting them with malicious code which is time triggered. But on Friday the attack didn’t come from computers. Instead it was non-computer devices connected to the Internet, what we collectively call the Internet of Things (IoT).
What are these Internet-connected things?
They are smartphones, smart TVs, security cameras, digital video recorders, smart thermostats, fridges and coffee makers. They are sensors in factories. They are controllers that turn the lights on and off in your home and increasingly assist you in your daily life by automating things domestic.
So how could such innocent and innocuous devices cause a DDoS?
Because these devices when built are designed to connect to the Internet. They come with default security, default passwords and user names. They come with instructions to users that tell them to personalize the information. Often users get notified of a software patch they need to upload to their device. But how many users update the software that resides in an Internet-connected fridge or coffee maker?
This Internet of Things is a Trojan Horse that can be exploited by hackers.
That’s what happened on Friday. Many millions of IoT devices targeted a specific Internet hub provider, Dyn, taking down its servers.
The malicious software code or malware that infected the devices used in the attack has been identifie as Mirai. The source code for Mirai can be found by anyone on the Internet. What Mirai does is seek IoT devices with factory-default user names and passwords and gets passed this base security. It then repurposes the devices to create Internet traffic aimed at targets.
A single product, a security surveillance camera, produced by a Chinese electronics company, XiongMai, found in many other security product offerings, is the suspect source of the Mirai infection. The webcam you use on your desktop computer, or the one in your laptop could just as easily have been penetrated by the malware used in this attack. So in effect you or I could be unwilling agents to the DDoS that felled Dyn’s services last Friday. And you will never know unless you registered the warranty for the device and receive regular notices of software patches or security updates.
Throughout Friday the DDoS attack spread across the United States and Canada and we were treated to maps (see image below) that showed the extent of its reach.
The attack was not the first and will not be the last. Companies and institutions that are the backbone of the Internet report increasing attacks. They are getting bigger and lasting longer. The attacks appear at times to be probing efforts to discover weaknesses in the security of sites they target. The longer an attack lasts the more a site reveals its defenses making it more vulnerable to future penetration.
So who wants to break the Internet? Are these state actors, individuals, or competitors to companies they target?
Are the attackers the same group stealing communications, emails and other forms of information from government, NGOs and company servers?
And what can be done about the rapid growth of IoT?
How do you stop consumers from loading up on devices like smartwatches, fitness trackers and a seemingly endless number of wi-fi gadgets that connect to the Internet?
What do you when the gadgets and control systems in cars, trucks and airplanes are all connected to the Internet?
The IoT is growing at a rapid rate with billions of devices already in place. In a recent BI Intelligence report it stated the following:
Knowing what happened last Friday and that IoT adoption is exploding across the planet should be a wake up call to governments, industry and consumers about the importance of implementing best security practices.
Defending the Internet is a global priority.
