Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

SUGGESTED FURTHER READING235do we attribute such an attack? How do we respond to cyber attacks on SCADA infrastructureby extragovernmental groups? How does the law of land warfare apply to cyber weapons thatcause real-world damage?There are several operational and technical questions that must be answered as well. In therealm of cyber warfare, technical and operational concerns often blend together. For example,how do we best identify zero-day vulnerabilities (which by definition are unknown)? Howcan we locate malicious software, such as Stuxnet, which was designed to go undetected?What security assumptions are we making that can be invalidated? How do we templatean unknown cyber threat?Will cyber weapons such as Stuxnet proliferate? Several security experts have predictedStuxnet-like variants to become more common. 70 There have already been reports ofnon-Stuxnet cyber attacks on industrial equipment in China. 71 Freely available analysis bySymantec, Kaspersky Labs, ESET, and Langner Communications GmbH, while useful froma defensive standpoint, can also be turned on its head and used as inspiration for Stuxnet-likeworms.By its nature, cyber warfare changes quickly. Motivated individuals and teams from government,corporate, academic, and black-hat (hacker) communities are constantly scrutinizingsystems for the latest vulnerabilities. However, Stuxnet represents a clear advance instate-of-the art—both as a piece of software and in what it accomplishes. It has revealedflawed assumptions of security that need to be revisited on multiple levels, but perhaps mostimportant, it showed that software can also be used as a decisive weapon system.SUMMARYIn this chapter, we saw how Stuxnet was designed to target ICS and successfully targetedthe Natanz FEP. It exploited not only five zero-day exploits but also many of the implicit trustrelationships common in ICS. This highly-specific piece of malware was designed with a certaintarget in mind and seemed to be designed to limit collateral damage. Perhaps Stuxnetmay be an indicator of cyber weapons to come.SUGGESTED FURTHER READINGThis chapter is based on the article “Stuxnet: Cyberwar Revolution in Military Affairs” byPaulo Shakarian that originally appeared in the April 2011 edition of Small Wars Journal—published online at smallwarsjournal.com. A Spanish-language translation of the article isalso available from Air and Space Power Journal. cPerhaps the best-known technical description of Stuxnet was written by Nicolas Falliere,Liam O Murchu, and Eric Chien of the Symantec Corporation entitled “W32.Stuxnet Dossier.”Another good technical description entitled “Stuxnet under the Microscope” was written byAleksandr Matrosov, Eugene Rodionov, David Harley, and Juraj Malcho of ESET.c http://www.airpower.au.af.mil/apjinternational/apj-s/2012/2012-3/2012_3_06_shakarian_s.pdf.