RiskUKAugust2017

How Can We Combat ‘Virtual Hackers’?
The WannaCry
ransomware attack in
May, which affected
elements of the
National Health
Service (NHS), has farreaching
implications
for the nature of the
threat presently facing
our connected
economy. Nicola
Whiting outlines the
growing threat of
automated cyber
weapons in criminal
hands and observes
how leading
organisations from
NATO to the FBI are
borrowing from the
hackers’ ‘playbook’
in order to fight back
The revelation that the WannaCry attack was
probably the work of a ‘script kiddie’
indicates that the automation of hacking
techniques is now enabling amateur hackers to
launch attacks with nation state-level expertise,
a development that dramatically increases the
severity of cyber threats facing today’s major
organisations. What was once the preserve of
military forces and spy agencies is now within
the reach of basement-dwelling hacktivists and
generalist cyber criminals.
The WannaCry network infection vector was
among a slew of sophisticated tools apparently
stolen from America’s National Security Agency,
demonstrating that advanced cyber warfare
technologies developed by Governments are
increasingly falling into the hands of ordinary
citizens. This could be construed as the
equivalent of intercontinental ballistic missiles
being stolen and sold to street criminals.
Not only does this development dramatically
increase the number of potentially devastating
cyber attacks the world might face in times
ahead, but also renders it that much harder for
the authorities to trace the perpetrators.
In the same way that automated cyber
weapons may replicate the work of skilled
Black Hat hackers, new software can
autonomously replicate the work of leading
White Hat hackers, analysing entire networks
for vulnerabilities with the knowledge and skills
of a penetration tester.
The WannaCry attack on the NHS is a good
example. Just as the attack was launched using
an automated network ‘worm’ coded to find
vulnerabilities, parts of the NHS were able to
use their own automated tools to identify
vulnerabilities and successfully protect
themselves against the attack.
Some NHS Trusts used the automated Nipper
Studio tool to replicate the skills of expert
human penetration testers and harden their
firewalls and network devices at a speed and
scale that’s beyond human capabilities, duly
finding and closing vulnerabilities before they
could be attacked.
Nipper Studio creates a virtual model of how
the setting and rules interact with each other
and understands the interactions just like a
human would, but in a fraction of the time and
with repeatable accuracy.
NHS Trusts with well-tested procedures in
place and which had used automation to
harden their networks against attack went
unbreached when WannaCry struck,
subsequently ensuring that the highly sensitive
information in their systems remained secure.
Rise of cyber warfare
Behind the escalation of cyber attacks lies the
increasing investment by Governments,
terrorists and other groups in ‘cyber-offensive’
capabilities: the development of hacking tools
that offer the ability to penetrate enemy
networks and systems and project ‘cyber
power’ around the world.
The capability of automated cyber warfare
systems was first illustrated by Stuxnet, a selfreplicating
cyber worm which destroyed over
1,000 nuclear centrifuges across an Iranian
nuclear facility, setting that nation’s nuclear
ambitions back by at least two years.
Security expert Claudio Guarnieri has noted
that the so-called Regin malware, recently used
to attack EU diplomatic delegations, also bore
the signature of a nation state spy apparatus.
Another such attack recently knocked out the
Ukraine’s national grid.
These military-grade cyber weapons are
percolating down into the online underworld,
largely because cyber weapons are far easier to
steal than conventional armaments. It’s both
easier and cheaper to copy a code than a cruise
missile. Today, an entire cyber arsenal can be
spirited away on a USB stick.
In the subterranean networks of The Dark
Web, there’s now a highly-developed cyber
60
www.risk-uk.com