Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

IRAN—HOW THE 2009 ELECTIONS LED TO AGGRESSIVE CYBER OPERATIONS59personal computer starts up. Essentially, it lets the rest of the computer know what the majorportions of the hard drive contain. Without this information, the computer cannot start upproperly. Shortly after the attack, a group of hackers calling themselves the “Cutting Swordof Justice” owned up to the incident and posted the IP addresses of the hacked computers onPastebin. 129Even though neither the Aramco nor the “Cutting Sword of Justice” identified the malwareused in the attack, security analysts found that the “Shamoon” malware included a commandto erase the MBR at the precise time of the Aramco attack and concluded that it was the cyberweapon used in the incident. 130 Some of the over-written files on the target computers werereplaced with images of burning American flags. 131 About a week after the attack, SaudiAramco chief executive Khalid al-Falih stated that the company had recovered from theattack and pointed out that the attack affected only the computer workstations—not systemscontrolling oil production. 132As with the attacks on the U.S. banks, several analysts pointed to Iran as the perpetrator forthe Aramco incident. 133 One interesting aspect of the Aramco attack is the fact that the attackersclaimed to be hacktivists yet other than hitherto known hacktivists conduct an attackusing a piece of malware—as opposed to a DDoS tool (such as those described already inChapters 2 and 3 and the LOIC tool described in Chapter 6). This could indicate that theCutting Sword either was somewhat savvier than a typical hacktivist group or were providedthe malware by a third party that holds a greater degree of sophistication. It is feasible that thisattack too was motivated by the resentment of the recent installment of economic sanctions onIran as mentioned earlier. Regardless, the Aramco attack, along with the attack against thebanks, was significant enough to warrant a statement by the U.S. Secretary of Defense LeonPanetta in October 2012 where he warned the business sector of the perils of such incidents(Figure 5.5). 134How do these two incidents illustrate the capabilities of groups such as the Iranian CyberArmy once they have control of a large number of compromised systems? Irrespective ofwhether or not these attacks were sanctioned by the Iranian government, it is clear that bothtargets aligned well with the politics of the Islamic state. It is notable that the capability tocompromise a large number of computer systems is also useful for intelligence gatheringFIGURE 5.5 The cyber attacks againstnumerous U.S. banks and Saudi oil interests inthe fall of 2012 led U.S. Secretary of Defense LeonPanetta (pictured) to make a public statementregarding these cyber operations in October2012. DoD photo: http://www.defense.gov/.