Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

4 1. CYBER WARFARE: HERE AND NOWHowever, some individuals during the era of insignificant activity on the field of cyberwarfare had a better intuition of what the future would hold. The computer science departmentat the U.S. Military West Point then headed by Colonel Gene Ressler, in particular,prepared future officers for serious cyber threats. With several undergraduate initiatives,including the “cyber defense exercise”—a competition to protect a computer network againsta team of hackers supplied by the National Security Agency, the program formed the avantgardein taking the possibilities of new technologies surrounding the Internet seriously.Students going through the exercise and associated classes were awarded an additional“Depth of Study in Information Assurance” in addition to their Bachelor’s degree. These initiativeswere started in 2001 and helped ensure that the U.S. Army had a group of well-trainedcyber warriors when Army Cyber Command was stood up nine years later.ATTRIBUTION, DECEPTION, AND INTELLIGENCEAs we will describe in this book, cyber warfare is a complicated matter due to a largevariety of issues—we have already touched on a few on a more abstract level in the section“Introduction.” One problem that seems to stand apart is the question of attribution—determining the creator and origin of a given cyber operation. To understand why this isso difficult, let us consider (at a coarse-grain level) how a security analyst examines theconsequences of an adversary’s cyber operation. The key item that (s)he studies is the cyberweaponry—the software used to conduct the attack—which is transmitted through theInternet (or through some closed network). To conduct any type of attribution in theaftermath of an attack, security analysts basically look at three things:1. Where (from what IP address) the software came from (origin)?2. How, when, and by whom was the software constructed (structure)?3. What was the software designed to do (purpose)?OriginSuppose that a security analyst can work through the obfuscations employed by a cyberwarrior to hide information regarding the software’s origins and find a source address (anInternet Protocol or IP address). Even if she or he can successfully reverse engineer the software,the analyst still faces the problem that the source IP address can be faked and reroutedthrough many different physical locations. Further, the source IP address of a given piece ofmalicious software (malware) may even be computer, which itself was compromised. Hence,an analyst can never be quite certain that she or he correctly determined from where in theworld the software originated.StructureScrutinizing the structure of the malware often proves tricky as well as this analysis posesits own unique set of challenges. Essentially, everything within a piece of software could