RSS

Is Stuxnet the new weapon for cyber insurgents?

21 Dec

Weaker combatants have always used unconventional or inexpensive means to defy stronger foes, including guerrilla warfare and suicide attacks that depend on a greater willingness to sacrifice life.

This approach can be decisive. Of all “asymmetric” wars since 1800 in which one side had far more armed power than the other, the weaker side won in 28 percent of cases, according to a 2001 study by US political scientist Ivan Arreguin-Toft.

The ratio may now be set to shift further in favour of the underdog.

The revelation this year of a novel way to use computers to sabotage an enemy’s lifeline infrastructure suggests a powerful new kind of weapon is moving within reach of weak states, militant groups and criminals, some analysts say.

That weapon is likely to be a variant of Stuxnet, a highly destructive Internet worm discovered by a Belarus company in June and described by European security company Kaspersky Labs as “a fearsome prototype of a cyber-weapon”, analysts say.

A GREAT DANGER”

“Stuxnet is like the arrival of an F-35 fighter jet on a World War I battlefield,” blogged German industrial control systems expert Ralph Langner.

Whoever created the bug, believed by many to have targeted an Iranian uranium enrichment facility, the job likely required many man-hours of work and millions of dollars in investment.

But now that its code has been publicly analysed, hackers will need only a few months to develop a version of the customised malware for black market sale, some experts say.

Ali Jahangiri, an information security expert who tracks Trojan codes, harmful pieces of software that look legitimate, describes that prospect as “a great danger.”

“The professional Trojan codemakers have got the idea from Stuxnet that they could make something similar which can be used by governments, criminals or terrorists,” he told Reuters.

Stuxnet’s menace is that it reprogrammes a control system used in many industrial facilities to inflict physical damage.
At risk is automation equipment common to the networks on which modern societies depend – power plants, refineries, chemical plants, pipelines and transport control systems.

beast image

Analysts say they suspect hackers are rushing to build a version of the worm and sell it to the highest bidder before experts can install counter-measures plants across the globe.

“My greatest fear is that we are running out of time to learn our lessons,” US information security expert Michael Assante told a Congressional hearing on Stuxnet this month.

Stuxnet … may very well serve as a blueprint for similar but new attacks on control system technology,” said Assante, President of the US National Board of Information Security Examiners, which sets standards for security professionals.

Langner says multinational efforts against malware inspired by Stuxnet won’t work since “treaties won’t be countersigned by rogue nation states, terrorists, organised crime, and hackers.”

“All of these will be able to possess and use such weapons soon,” he said. If the next Stuxnet cost less than $1 million on the black market, then “some not-so-well equipped nation states and well-funded terrorists will grab their checkbooks.”

As well as favouring small states, cyber appears to be a tool of special value for Russia and China, since it allows them to become equals to the United States in a sphere where US conventional military dominance counts for nothing.

Stuxnet is a powerful example of the fastest-growing sort of computer bug – customised malware written specifically to attack a precise target. What is new is its power, and the publicity it has attracted through a presumed link to Iran.

beast image

That publicity will have drawn attention in small nations such as North Korea, which can be expected to take an interest in acquiring a Stuxnet-like capability to balance an inferiority in conventional arms with its US-backed southern foe.

Like some impoverished countries in Africa, North Korea has a cyber advantage – it has so few systems dependent on digital networks that a big cyber attack on it would cause almost no damage, writes former US National Security Coordinator Richard Clarke in his book Cyber War.

Advertisements
 
3 Comments

Posted by on December 21, 2010 in Uncategorized

 

Tags: , ,

3 responses to “Is Stuxnet the new weapon for cyber insurgents?

  1. Rey Tabuena

    January 9, 2011 at 4:16 am

    Thanks for this post. I more than likely agree with what you are saying. I have been talking about this subject a lot lately with my father so may possibly this will get him to see my point of view. Fingers crossed!

     
  2. ptzip

    January 11, 2011 at 1:44 pm

    Great site, though I would love to see some more media! – Great post anyway, Cheers!

     
  3. terapie ozon

    January 12, 2011 at 4:34 pm

    I spend a lot of time looking for interesting blogs, but articles like yours are rare to find. Keep it up, you’re doing a good job.

     

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s